Skip to content

Commit 0a6ccbc

Browse files
committed
Add stubs and tests for new hardcoded-credential sinks
1 parent 60e0f09 commit 0a6ccbc

File tree

231 files changed

+5520
-7
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

231 files changed

+5520
-7
lines changed
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import org.apache.commons.net.ftp.FTPClient;
2+
3+
import java.io.IOException;
4+
5+
public class HardcodedApacheFtpCredentials {
6+
public static void main(FTPClient client) {
7+
// BAD: Hardcoded credentials used for the session username and/or password.
8+
try {
9+
client.login("username", "password");
10+
client.login("username", "password", "blah");
11+
} catch(IOException e) { }
12+
}
13+
}
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import org.apache.sshd.client.SshClient;
2+
import org.apache.sshd.client.session.AbstractClientSession;
3+
import java.io.IOException;
4+
5+
public class HardcodedApacheSshdCredentials {
6+
public static void main(SshClient client, AbstractClientSession session) {
7+
// BAD: Hardcoded credentials used for the session username and/or password.
8+
client.connect("Username", "hostname", 22);
9+
client.connect("Username", null);
10+
session.addPasswordIdentity("password");
11+
}
12+
}

java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCredentialsApiCall.expected

Lines changed: 96 additions & 0 deletions
Large diffs are not rendered by default.

java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCredentialsSourceCall.expected

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ edges
1515
| User.java:2:30:2:39 | DEFAULT_PW : String | User.java:5:15:5:24 | DEFAULT_PW |
1616
| User.java:2:43:2:50 | "123456" : String | User.java:2:30:2:39 | DEFAULT_PW : String |
1717
nodes
18+
| HardcodedApacheFtpCredentials.java:9:20:9:29 | "username" | semmle.label | "username" |
19+
| HardcodedApacheFtpCredentials.java:9:32:9:41 | "password" | semmle.label | "password" |
20+
| HardcodedApacheFtpCredentials.java:10:20:10:29 | "username" | semmle.label | "username" |
21+
| HardcodedApacheFtpCredentials.java:10:32:10:41 | "password" | semmle.label | "password" |
1822
| HardcodedAzureCredentials.java:8:14:8:38 | this <.method> [post update] [clientSecret] : String | semmle.label | this <.method> [post update] [clientSecret] : String |
1923
| HardcodedAzureCredentials.java:8:14:8:38 | this <.method> [post update] [username] : String | semmle.label | this <.method> [post update] [username] : String |
2024
| HardcodedAzureCredentials.java:10:2:10:68 | this <.field> [post update] [username] : String | semmle.label | this <.field> [post update] [username] : String |
@@ -29,14 +33,74 @@ nodes
2933
| HardcodedAzureCredentials.java:19:13:19:24 | this <.field> [clientSecret] : String | semmle.label | this <.field> [clientSecret] : String |
3034
| HardcodedAzureCredentials.java:61:3:61:33 | new HardcodedAzureCredentials(...) [clientSecret] : String | semmle.label | new HardcodedAzureCredentials(...) [clientSecret] : String |
3135
| HardcodedAzureCredentials.java:61:3:61:33 | new HardcodedAzureCredentials(...) [username] : String | semmle.label | new HardcodedAzureCredentials(...) [username] : String |
36+
| HardcodedGanymedSsh2Credentials.java:8:35:8:44 | "username" | semmle.label | "username" |
37+
| HardcodedGanymedSsh2Credentials.java:8:47:8:56 | "password" | semmle.label | "password" |
38+
| HardcodedJ2sshCredentials.java:7:25:7:34 | "Username" | semmle.label | "Username" |
39+
| HardcodedJ2sshCredentials.java:8:25:8:34 | "Username" | semmle.label | "Username" |
40+
| HardcodedJ2sshCredentials.java:9:25:9:34 | "password" | semmle.label | "password" |
41+
| HardcodedJschCredentials.java:10:41:10:50 | "Username" | semmle.label | "Username" |
42+
| HardcodedJschCredentials.java:11:42:11:51 | "Username" | semmle.label | "Username" |
43+
| HardcodedJschCredentials.java:12:27:12:36 | "password" | semmle.label | "password" |
44+
| HardcodedMongoCredentials.java:5:38:5:47 | "Username" | semmle.label | "Username" |
45+
| HardcodedMongoCredentials.java:6:45:6:54 | "Username" | semmle.label | "Username" |
46+
| HardcodedMongoCredentials.java:7:43:7:52 | "Username" | semmle.label | "Username" |
47+
| HardcodedMongoCredentials.java:8:47:8:56 | "Username" | semmle.label | "Username" |
48+
| HardcodedMongoCredentials.java:9:44:9:48 | "key" | semmle.label | "key" |
49+
| HardcodedMongoCredentials.java:10:47:10:51 | "key" | semmle.label | "key" |
50+
| HardcodedSshjCredentials.java:8:25:8:34 | "Username" | semmle.label | "Username" |
51+
| HardcodedSshjCredentials.java:8:37:8:46 | "password" | semmle.label | "password" |
52+
| HardcodedSshjCredentials.java:9:27:9:36 | "Username" | semmle.label | "Username" |
53+
| HardcodedTrileadSshCredentials.java:10:37:10:46 | "Username" | semmle.label | "Username" |
54+
| HardcodedTrileadSshCredentials.java:10:49:10:58 | "password" | semmle.label | "password" |
55+
| HardcodedTrileadSshCredentials.java:11:32:11:41 | "Username" | semmle.label | "Username" |
56+
| HardcodedTrileadSshCredentials.java:11:56:11:60 | "key" | semmle.label | "key" |
57+
| HardcodedTrileadSshCredentials.java:12:33:12:42 | "Username" | semmle.label | "Username" |
58+
| HardcodedTrileadSshCredentials.java:13:36:13:45 | "Username" | semmle.label | "Username" |
59+
| HardcodedTrileadSshCredentials.java:14:34:14:43 | "Username" | semmle.label | "Username" |
60+
| HardcodedTrileadSshCredentials.java:15:38:15:47 | "Username" | semmle.label | "Username" |
61+
| HardcodedTrileadSshCredentials.java:15:71:15:80 | "password" | semmle.label | "password" |
62+
| HardcodedTrileadSshCredentials.java:16:38:16:47 | "Username" | semmle.label | "Username" |
63+
| HardcodedTrileadSshCredentials.java:16:62:16:71 | "password" | semmle.label | "password" |
3264
| Test.java:10:17:10:24 | "123456" : String | semmle.label | "123456" : String |
3365
| Test.java:26:17:26:20 | pass | semmle.label | pass |
3466
| User.java:2:30:2:39 | DEFAULT_PW : String | semmle.label | DEFAULT_PW : String |
3567
| User.java:2:43:2:50 | "123456" : String | semmle.label | "123456" : String |
3668
| User.java:5:15:5:24 | DEFAULT_PW | semmle.label | DEFAULT_PW |
3769
subpaths
3870
#select
71+
| HardcodedApacheFtpCredentials.java:9:20:9:29 | "username" | HardcodedApacheFtpCredentials.java:9:20:9:29 | "username" | HardcodedApacheFtpCredentials.java:9:20:9:29 | "username" | Hard-coded value flows to $@. | HardcodedApacheFtpCredentials.java:9:20:9:29 | "username" | sensitive call |
72+
| HardcodedApacheFtpCredentials.java:9:32:9:41 | "password" | HardcodedApacheFtpCredentials.java:9:32:9:41 | "password" | HardcodedApacheFtpCredentials.java:9:32:9:41 | "password" | Hard-coded value flows to $@. | HardcodedApacheFtpCredentials.java:9:32:9:41 | "password" | sensitive call |
73+
| HardcodedApacheFtpCredentials.java:10:20:10:29 | "username" | HardcodedApacheFtpCredentials.java:10:20:10:29 | "username" | HardcodedApacheFtpCredentials.java:10:20:10:29 | "username" | Hard-coded value flows to $@. | HardcodedApacheFtpCredentials.java:10:20:10:29 | "username" | sensitive call |
74+
| HardcodedApacheFtpCredentials.java:10:32:10:41 | "password" | HardcodedApacheFtpCredentials.java:10:32:10:41 | "password" | HardcodedApacheFtpCredentials.java:10:32:10:41 | "password" | Hard-coded value flows to $@. | HardcodedApacheFtpCredentials.java:10:32:10:41 | "password" | sensitive call |
3975
| HardcodedAzureCredentials.java:10:34:10:67 | "username@example.onmicrosoft.com" | HardcodedAzureCredentials.java:10:34:10:67 | "username@example.onmicrosoft.com" : String | HardcodedAzureCredentials.java:18:13:18:20 | username | Hard-coded value flows to $@. | HardcodedAzureCredentials.java:18:13:18:20 | username | sensitive call |
4076
| HardcodedAzureCredentials.java:11:38:11:73 | "1n1.qAc~3Q-1t38aF79Xzv5AUEfR5-ct3_" | HardcodedAzureCredentials.java:11:38:11:73 | "1n1.qAc~3Q-1t38aF79Xzv5AUEfR5-ct3_" : String | HardcodedAzureCredentials.java:19:13:19:24 | clientSecret | Hard-coded value flows to $@. | HardcodedAzureCredentials.java:19:13:19:24 | clientSecret | sensitive call |
77+
| HardcodedGanymedSsh2Credentials.java:8:35:8:44 | "username" | HardcodedGanymedSsh2Credentials.java:8:35:8:44 | "username" | HardcodedGanymedSsh2Credentials.java:8:35:8:44 | "username" | Hard-coded value flows to $@. | HardcodedGanymedSsh2Credentials.java:8:35:8:44 | "username" | sensitive call |
78+
| HardcodedGanymedSsh2Credentials.java:8:47:8:56 | "password" | HardcodedGanymedSsh2Credentials.java:8:47:8:56 | "password" | HardcodedGanymedSsh2Credentials.java:8:47:8:56 | "password" | Hard-coded value flows to $@. | HardcodedGanymedSsh2Credentials.java:8:47:8:56 | "password" | sensitive call |
79+
| HardcodedJ2sshCredentials.java:7:25:7:34 | "Username" | HardcodedJ2sshCredentials.java:7:25:7:34 | "Username" | HardcodedJ2sshCredentials.java:7:25:7:34 | "Username" | Hard-coded value flows to $@. | HardcodedJ2sshCredentials.java:7:25:7:34 | "Username" | sensitive call |
80+
| HardcodedJ2sshCredentials.java:8:25:8:34 | "Username" | HardcodedJ2sshCredentials.java:8:25:8:34 | "Username" | HardcodedJ2sshCredentials.java:8:25:8:34 | "Username" | Hard-coded value flows to $@. | HardcodedJ2sshCredentials.java:8:25:8:34 | "Username" | sensitive call |
81+
| HardcodedJ2sshCredentials.java:9:25:9:34 | "password" | HardcodedJ2sshCredentials.java:9:25:9:34 | "password" | HardcodedJ2sshCredentials.java:9:25:9:34 | "password" | Hard-coded value flows to $@. | HardcodedJ2sshCredentials.java:9:25:9:34 | "password" | sensitive call |
82+
| HardcodedJschCredentials.java:10:41:10:50 | "Username" | HardcodedJschCredentials.java:10:41:10:50 | "Username" | HardcodedJschCredentials.java:10:41:10:50 | "Username" | Hard-coded value flows to $@. | HardcodedJschCredentials.java:10:41:10:50 | "Username" | sensitive call |
83+
| HardcodedJschCredentials.java:11:42:11:51 | "Username" | HardcodedJschCredentials.java:11:42:11:51 | "Username" | HardcodedJschCredentials.java:11:42:11:51 | "Username" | Hard-coded value flows to $@. | HardcodedJschCredentials.java:11:42:11:51 | "Username" | sensitive call |
84+
| HardcodedJschCredentials.java:12:27:12:36 | "password" | HardcodedJschCredentials.java:12:27:12:36 | "password" | HardcodedJschCredentials.java:12:27:12:36 | "password" | Hard-coded value flows to $@. | HardcodedJschCredentials.java:12:27:12:36 | "password" | sensitive call |
85+
| HardcodedMongoCredentials.java:5:38:5:47 | "Username" | HardcodedMongoCredentials.java:5:38:5:47 | "Username" | HardcodedMongoCredentials.java:5:38:5:47 | "Username" | Hard-coded value flows to $@. | HardcodedMongoCredentials.java:5:38:5:47 | "Username" | sensitive call |
86+
| HardcodedMongoCredentials.java:6:45:6:54 | "Username" | HardcodedMongoCredentials.java:6:45:6:54 | "Username" | HardcodedMongoCredentials.java:6:45:6:54 | "Username" | Hard-coded value flows to $@. | HardcodedMongoCredentials.java:6:45:6:54 | "Username" | sensitive call |
87+
| HardcodedMongoCredentials.java:7:43:7:52 | "Username" | HardcodedMongoCredentials.java:7:43:7:52 | "Username" | HardcodedMongoCredentials.java:7:43:7:52 | "Username" | Hard-coded value flows to $@. | HardcodedMongoCredentials.java:7:43:7:52 | "Username" | sensitive call |
88+
| HardcodedMongoCredentials.java:8:47:8:56 | "Username" | HardcodedMongoCredentials.java:8:47:8:56 | "Username" | HardcodedMongoCredentials.java:8:47:8:56 | "Username" | Hard-coded value flows to $@. | HardcodedMongoCredentials.java:8:47:8:56 | "Username" | sensitive call |
89+
| HardcodedMongoCredentials.java:9:44:9:48 | "key" | HardcodedMongoCredentials.java:9:44:9:48 | "key" | HardcodedMongoCredentials.java:9:44:9:48 | "key" | Hard-coded value flows to $@. | HardcodedMongoCredentials.java:9:44:9:48 | "key" | sensitive call |
90+
| HardcodedMongoCredentials.java:10:47:10:51 | "key" | HardcodedMongoCredentials.java:10:47:10:51 | "key" | HardcodedMongoCredentials.java:10:47:10:51 | "key" | Hard-coded value flows to $@. | HardcodedMongoCredentials.java:10:47:10:51 | "key" | sensitive call |
91+
| HardcodedSshjCredentials.java:8:25:8:34 | "Username" | HardcodedSshjCredentials.java:8:25:8:34 | "Username" | HardcodedSshjCredentials.java:8:25:8:34 | "Username" | Hard-coded value flows to $@. | HardcodedSshjCredentials.java:8:25:8:34 | "Username" | sensitive call |
92+
| HardcodedSshjCredentials.java:8:37:8:46 | "password" | HardcodedSshjCredentials.java:8:37:8:46 | "password" | HardcodedSshjCredentials.java:8:37:8:46 | "password" | Hard-coded value flows to $@. | HardcodedSshjCredentials.java:8:37:8:46 | "password" | sensitive call |
93+
| HardcodedSshjCredentials.java:9:27:9:36 | "Username" | HardcodedSshjCredentials.java:9:27:9:36 | "Username" | HardcodedSshjCredentials.java:9:27:9:36 | "Username" | Hard-coded value flows to $@. | HardcodedSshjCredentials.java:9:27:9:36 | "Username" | sensitive call |
94+
| HardcodedTrileadSshCredentials.java:10:37:10:46 | "Username" | HardcodedTrileadSshCredentials.java:10:37:10:46 | "Username" | HardcodedTrileadSshCredentials.java:10:37:10:46 | "Username" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:10:37:10:46 | "Username" | sensitive call |
95+
| HardcodedTrileadSshCredentials.java:10:49:10:58 | "password" | HardcodedTrileadSshCredentials.java:10:49:10:58 | "password" | HardcodedTrileadSshCredentials.java:10:49:10:58 | "password" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:10:49:10:58 | "password" | sensitive call |
96+
| HardcodedTrileadSshCredentials.java:11:32:11:41 | "Username" | HardcodedTrileadSshCredentials.java:11:32:11:41 | "Username" | HardcodedTrileadSshCredentials.java:11:32:11:41 | "Username" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:11:32:11:41 | "Username" | sensitive call |
97+
| HardcodedTrileadSshCredentials.java:11:56:11:60 | "key" | HardcodedTrileadSshCredentials.java:11:56:11:60 | "key" | HardcodedTrileadSshCredentials.java:11:56:11:60 | "key" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:11:56:11:60 | "key" | sensitive call |
98+
| HardcodedTrileadSshCredentials.java:12:33:12:42 | "Username" | HardcodedTrileadSshCredentials.java:12:33:12:42 | "Username" | HardcodedTrileadSshCredentials.java:12:33:12:42 | "Username" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:12:33:12:42 | "Username" | sensitive call |
99+
| HardcodedTrileadSshCredentials.java:13:36:13:45 | "Username" | HardcodedTrileadSshCredentials.java:13:36:13:45 | "Username" | HardcodedTrileadSshCredentials.java:13:36:13:45 | "Username" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:13:36:13:45 | "Username" | sensitive call |
100+
| HardcodedTrileadSshCredentials.java:14:34:14:43 | "Username" | HardcodedTrileadSshCredentials.java:14:34:14:43 | "Username" | HardcodedTrileadSshCredentials.java:14:34:14:43 | "Username" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:14:34:14:43 | "Username" | sensitive call |
101+
| HardcodedTrileadSshCredentials.java:15:38:15:47 | "Username" | HardcodedTrileadSshCredentials.java:15:38:15:47 | "Username" | HardcodedTrileadSshCredentials.java:15:38:15:47 | "Username" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:15:38:15:47 | "Username" | sensitive call |
102+
| HardcodedTrileadSshCredentials.java:15:71:15:80 | "password" | HardcodedTrileadSshCredentials.java:15:71:15:80 | "password" | HardcodedTrileadSshCredentials.java:15:71:15:80 | "password" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:15:71:15:80 | "password" | sensitive call |
103+
| HardcodedTrileadSshCredentials.java:16:38:16:47 | "Username" | HardcodedTrileadSshCredentials.java:16:38:16:47 | "Username" | HardcodedTrileadSshCredentials.java:16:38:16:47 | "Username" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:16:38:16:47 | "Username" | sensitive call |
104+
| HardcodedTrileadSshCredentials.java:16:62:16:71 | "password" | HardcodedTrileadSshCredentials.java:16:62:16:71 | "password" | HardcodedTrileadSshCredentials.java:16:62:16:71 | "password" | Hard-coded value flows to $@. | HardcodedTrileadSshCredentials.java:16:62:16:71 | "password" | sensitive call |
41105
| Test.java:10:17:10:24 | "123456" | Test.java:10:17:10:24 | "123456" : String | Test.java:26:17:26:20 | pass | Hard-coded value flows to $@. | Test.java:26:17:26:20 | pass | sensitive call |
42106
| User.java:2:43:2:50 | "123456" | User.java:2:43:2:50 | "123456" : String | User.java:5:15:5:24 | DEFAULT_PW | Hard-coded value flows to $@. | User.java:5:15:5:24 | DEFAULT_PW | sensitive call |
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
import ch.ethz.ssh2.Connection;
2+
import java.io.IOException;
3+
4+
public class HardcodedGanymedSsh2Credentials {
5+
public static void main(Connection conn) {
6+
// BAD: Hardcoded credentials used for the session username and/or password.
7+
try {
8+
conn.authenticateWithPassword("username", "password");
9+
} catch(IOException e) { }
10+
}
11+
}
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
import com.sshtools.j2ssh.authentication.SshAuthenticationClient;
2+
import com.sshtools.j2ssh.authentication.PasswordAuthenticationClient;
3+
4+
public class HardcodedJ2sshCredentials {
5+
public static void main(SshAuthenticationClient client1, PasswordAuthenticationClient client2) {
6+
// BAD: Hardcoded credentials used for the session username and/or password.
7+
client1.setUsername("Username");
8+
client2.setUsername("Username");
9+
client2.setPassword("password");
10+
}
11+
}
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
import com.jcraft.jsch.JSch;
2+
import com.jcraft.jsch.JSchException;
3+
import com.jcraft.jsch.Session;
4+
import java.io.IOException;
5+
6+
public class HardcodedJschCredentials {
7+
public static void main(JSch jsch) {
8+
// BAD: Hardcoded credentials used for the session username and/or password.
9+
try {
10+
Session session = jsch.getSession("Username", "hostname");
11+
Session session2 = jsch.getSession("Username", "hostname", 22);
12+
session.setPassword("password");
13+
session2.setPassword("password".getBytes());
14+
} catch(JSchException e) { }
15+
}
16+
}
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import com.mongodb.MongoCredential;
2+
3+
public class HardcodedMongoCredentials {
4+
public static void test() {
5+
MongoCredential.createCredential("Username", "blah", "password".toCharArray());
6+
MongoCredential.createMongoCRCredential("Username", "blah", "password".toCharArray());
7+
MongoCredential.createPlainCredential("Username", "blah", "password".toCharArray());
8+
MongoCredential.createScramSha1Credential("Username", "blah", "password".toCharArray());
9+
MongoCredential.createGSSAPICredential("key");
10+
MongoCredential.createMongoX509Credential("key");
11+
}
12+
}
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import net.schmizz.sshj.SSHClient;
2+
import java.io.IOException;
3+
4+
public class HardcodedSshjCredentials {
5+
public static void main(SSHClient client) {
6+
// BAD: Hardcoded credentials used for the session username and/or password.
7+
try {
8+
client.authPassword("Username", "password");
9+
client.authPassword("Username", "password".toCharArray());
10+
}
11+
catch(IOException e) { }
12+
}
13+
}
Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
import com.trilead.ssh2.Connection;
2+
3+
import java.io.IOException;
4+
import java.io.File;
5+
6+
public class HardcodedTrileadSshCredentials {
7+
public static void main(Connection conn) {
8+
// BAD: Hardcoded credentials used for the session username and/or password.
9+
try {
10+
conn.authenticateWithPassword("Username", "password");
11+
conn.authenticateWithDSA("Username", "password", "key");
12+
conn.authenticateWithNone("Username");
13+
conn.getRemainingAuthMethods("Username");
14+
conn.isAuthMethodAvailable("Username", "method");
15+
conn.authenticateWithPublicKey("Username", "key".toCharArray(), "password");
16+
conn.authenticateWithPublicKey("Username", (File)null, "password");
17+
} catch(IOException e) { }
18+
}
19+
}

0 commit comments

Comments
 (0)