Details

    • Message:
      "xxxxx" detected in this variable name, review this potentially hard-coded credential.
    • List of parameters:
      • Key : credentialWords
      • Description : Comma separated list of words identifying potential credentials
      • Default value : password, passwd, pwd
    • Default Severity:
      Blocker
    • Impact:
      High
    • Likelihood:
      High
    • Default Quality Profiles:
      Sonar way, MISRA C++ 2008 recommended
    • Targeted languages:
      C, C++, Cobol, Flex, JavaScript, Objective-C, PL/I, PL/SQL, Python, RPG, VB6
    • Covered Languages:
      ABAP, C#, Go, Java, Kotlin, PHP, Ruby, Scala, Swift, T-SQL, TypeScript, VB.Net
    • Irrelevant for Languages:
      HTML, XML
    • Remediation Function:
      Constant/Issue
    • Constant Cost:
      30min
    • Analysis Level:
      Syntactic Analysis
    • Analysis Scope:
      Main Sources
    • Implementation details:
    • Common Rule:
      Yes
    • CERT:
      MSC03-J.
    • CWE:
      CWE-798, CWE-259
    • OWASP:
      A2
    • SANS Top 25:
      Porous Defenses
    • FindBugs:
      DMI_CONSTANT_DB_PASSWORD
    • FindSecBugs:
      HARD_CODE_PASSWORD
    • TSLint-SonarTS:
      no-hardcoded-credentials

      Description

      Because it is easy to extract strings from a compiled application, credentials should never be hard-coded. Do so, and they're almost guaranteed to end up in the hands of an attacker. This is particularly true for applications that are distributed.

      Credentials should be stored outside of the code in a strongly-protected encrypted configuration file or database.

      This rule flags instances of hard-coded credentials used in database and LDAP connections. It looks for hard-coded credentials in connection strings, and for variable names that match any of the patterns from the provided list.

      It's recommended to customize the configuration of this rule with additional credential words such as "oauthToken", "secret", ...

      See

        Attachments

          Issue Links

          1.
          Java RSPEC-2069 Language-Specification Active Unassigned
          2.
          Swift RSPEC-2855 Language-Specification Active Unassigned
          3.
          PHP RSPEC-2965 Language-Specification Active Unassigned
          4.
          Cobol RSPEC-3383 Language-Specification Active Unassigned
          5.
          C# RSPEC-4020 Language-Specification Active Unassigned
          6.
          TypeScript RSPEC-4475 Language-Specification Active Unassigned
          7.
          Go RSPEC-4513 Language-Specification Active Unassigned
          8.
          Kotlin RSPEC-4691 Language-Specification Active Unassigned
          9.
          ABAP RSPEC-4811 Language-Specification Active Unassigned
          10.
          VB.NET RSPEC-4877 Language-Specification Active Unassigned
          11.
          Apex RSPEC-5023 Language-Specification Active Unassigned

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                ann.campbell.2 Ann Campbell
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated: