two paths

Author: tomasz-tylenda-sonarsource

sonar-xml-plugin/src/main/java/org/sonar/plugins/xml/checks/security/HardcodedCredentialsCheck.java

@@ -47,7 +47,7 @@ public class HardcodedCredentialsCheck extends SimpleXPathBasedCheck {
   private static final XPathExpression WEB_CONFIG_CREDENTIALS_PATH = XPathBuilder
     .forExpression("/configuration/system.web/authentication[@mode=\"Forms\"]/forms/credentials[@passwordFormat=\"Clear\"]/user/@password[string-length(.) > 0]").build();
 
-  private static final XPathExpression WEB_CONFIG_USER1192 = XPathBuilder
+  private static final XPathExpression WEB_CONFIG_APP_SETTINGS_PATH = XPathBuilder
     .forExpression("//appSettings/add[\"lower-case(@key)='password'\"]").build();
 
   private static final Pattern VALID_CREDENTIAL_VALUES = Pattern.compile("[\\{$#]\\{");
@@ -80,9 +80,11 @@ private Set<String> credentialWordsSet() {
   @Override
   public void scanFile(XmlFile file) {
     if (Xml.isDotNetApplicationConfig(file.getInputFile())) {
-      evaluateAsList(WEB_CONFIG_USER1192, file.getDocument()).stream()
+      evaluateAsList(WEB_CONFIG_CREDENTIALS_PATH, file.getDocument()).stream()
         .filter(passwordAttrNode -> !isValidWebConfigCredential(passwordAttrNode.getNodeValue()))
         .forEach(this::reportIssue);
+      evaluateAsList(WEB_CONFIG_APP_SETTINGS_PATH, file.getDocument()).stream()
+        .forEach(this::reportIssue);
     } else {
       checkElements(file.getDocument());
       checkSpecialCases(file);