Page History

...

Hard coding sensitive information also increases the need to manage and accommodate changes to the code. For example, changing a hard -coded password in a fieldeddeployed program may require distribution of a patch \[[Chess 2007|AA. Bibliography#Chess 07]\].

...

This noncompliant code example uses includes a password field hard-coded server IP address in a constant String.

class PasswordIPaddress {
  String passwordipAddress = new String("guest172.16.254.1");
  public static void main(String[] args) {
    //..
  }
}

A malicious user can use the javap -c PasswordIPaddress command to disassemble the class and discover the hard-coded passwordserver IP address. The output of the disassembler , as shown below, reveals the password guest reveals the server IP address 172.16.254.1 in clear text.:

Compiled from "PasswordIPaddress.java"
class PasswordIPaddress extends java.lang.Object{
java.lang.String passwordipAddress;

PasswordIPaddress();
  Code:
   0:	     aload_0
   1:	invokespecial	     invokespecial     #1; //Method java/lang/Object."<init>":()V
   4:	     aload_0
   5:	new	     new   #2; //class java/lang/String
   8:	     dup
   9:	ldc	     ldc   #3; //String guest172.16.254.1
   11:	invokespecial	    invokespecial     #4; //Method java/lang/String."<init>":(Ljava/lang/String;)V
   14:	putfield	    putfield    #5; //Field passwordipAddress:Ljava/lang/String;
   17:	    return

public static void main(java.lang.String[]);
  Code:
   0:	     return

}

Compliant Solution

This compliant solution retrieves the password server IP address from an external file located in a secure directory. Exposure is further limited by clearing the password in server IP address from memory immediately after use.

class PasswordIPaddress {
  public static void main(String[] args) throws IOException {
    char[] passwordipAddress = new char[100];	
    BufferedReader br = new BufferedReader(new InputStreamReader(
        new FileInputStream("credentialsserveripaddress.txt")));

    // Reads the server passwordIP address into the char array,
    // returns the number of bytes read 
    int n = br.read(passwordipAddress);  
    // Validate server IP address
    // Decrypt password and validate Manually clear out the server IP address
    // immediately after use 
    for (int i = n - 1; i >= 0; i--) {  // Manually clear out the password immediately after use 
      passwordipAddress[i] = 0;	 
    }
    br.close();
  }
}

To further limit the exposure time of the sensitive passwordserver IP address, replace BufferedReader with a direct native input/output (NIO) buffer, which can be cleared immediately after use.

Noncompliant Code Example (Hard-Coded Database Password)

This noncompliant code example hard codes the The user name and password fields in the SQL connection request are hard coded in this noncompliant code example.

public final Connection getConnection() throws SQLException {
  return DriverManager.getConnection(
      "jdbc:mysql://localhost/dbName", 
      "username", "password");
}

Note that the one-and-two argument java.sql.DriverManager.getConnection() methods can also be used incorrectly. Applets that contain similar code are also unacceptable because they may be executed in untrusted environments.

Compliant Solution

This compliant solution reads the user name and password from a configuration file located in a secure directory.

public final Connection getConnection() throws SQLException {
  char[] username = new char[16];
  char[] password = new char[16];
  // Username and password are read at runtime from a secure config file
  return DriverManager.getConnection(
      "jdbc:mysql://localhost/dbName",
      username, password);
  for (int i = username.length - 1; i >= 0; i--) {  
    username[i] = 0;
  }
  for (int i = password.length - 1; i >= 0; i--) {  
    password[i] = 0;
  }

}

It is also permissible to prompt the user for the user name and password at runtime.

...

GERONIMO-2925, GERONIMO-1135 describes a vulnerability in the WAS CE tool, which is based on Apache Geronimo. It uses Advanced Encryption Standard (AES) to encrypt passwords but uses a hard-coded key that is identical for all the WAS CE server instances. Consequently, anyone who can download the software is provided with the key to every instance of the tool. This vulnerability was resolved by having each new installation of the tool generate its own unique key and use it henceforth.

Related Guidelines

Bibliography

...