...
Code Block | ||
---|---|---|
| ||
class Hardcoded { String password = new String("guest""guest"); public static void main(String[] args) { //.. } } |
A malicious user can use the javap -c Hardcoded
command to disassemble the class and discover the hardcoded password. The output of the disassembler as shown below, reveals the password guest
in cleartext.
Code Block |
---|
Compiled from ""Hardcoded.java"" class Hardcoded extends java.lang.Object{ java.lang.String password; Hardcoded(); Code: 0: aload_0 1: invokespecial #1; //Method java/lang/Object."<init>""<init>":()V 4: aload_0 5: new #2; //class java/lang/String 8: dup 9: ldc #3; //String guest 11: invokespecial #4; //Method java/lang/String."<init>""<init>":(Ljava/lang/String;)V 14: putfield #5; //Field password:Ljava/lang/String; 17: return public static void main(java.lang.String[]); Code: 0: return } |
...
Code Block | ||
---|---|---|
| ||
class Password { public static void main(String[] args) throws IOException { char[] password = new char[100]; BufferedReader br = new BufferedReader(new InputStreamReader( new FileInputStream(""password.txt""))); // Reads the password into the char array, returns the number of bytes read int n = br.read(password); // Decrypt password, perform operations for(int i = n - 1; i >>= 0; i--) { // Manually clear out the password immediately after use password[i] = 0; } br.close(); } } |
...
Code Block | ||
---|---|---|
| ||
public final Connection getConnection() throws SQLException { return DriverManager.getConnection(""jdbc:mysql://localhost/dbName"", "username""username", "password""password"); } |
Note that the one and two argument java.sql.DriverManager.getConnection()
methods may also be used incorrectly. Applets that contain similar code are also noncompliant because they may be executed in untrusted environments.
...
Code Block | ||
---|---|---|
| ||
// Username and password are read at runtime from a secure config file public final Connection getConnection() throws SQLException { return DriverManager.getConnection(""jdbc:mysql://localhost/dbName"", username, password); } |
It is also permissible to prompt the user for the user name and password at runtime and use the entered values.
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Other Languages
This rule appears in the C Secure Coding Standard as MSC18-C. Be careful while handling sensitive data, such as passwords, in program code
...
Wiki Markup |
---|
\[[Gong 03|AA. Java References#Gong 03]\] 9.4 Private Object State and Object Immutability \[[Chess 07|AA. Java References#Chess 07]\] 11.2 Outbound Passwords: Keep Passwords out of Source Code \[[Fortify 08|AA. Java References#Fortify 08]\] ""Unsafe Mobile Code: Database Access"" \[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 259|http://cwe.mitre.org/data/definitions/259.html] ""Hard-Coded Password"" |
...
MSC30-J. Generate truly random numbers 49. Miscellaneous (MSC) IDS03-J. Prevent OS Command Injection