Skip to content

Commit d469e9b

Browse files
committed
Format the code and minor text change
1 parent e27ccd0 commit d469e9b

File tree

3 files changed

+28
-13
lines changed

3 files changed

+28
-13
lines changed

java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,4 @@ where
3434
)
3535
or
3636
a.getValue().regexpMatch("(?is).*(pwd|password)\\s*=(?!\\s*;).*") // Attribute value matches password pattern
37-
select a, "Plaintext passwords in configuration files."
37+
select a, "Plaintext password in configuration file."
Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
| applicationContext.xml:9:3:9:48 | name=password | Plaintext passwords in configuration files. |
2-
| context.xml:4:5:4:253 | password=1234 | Plaintext passwords in configuration files. |
1+
| applicationContext.xml:9:3:9:48 | name=password | Plaintext password in configuration file. |
2+
| context.xml:4:2:8:50 | password=1234 | Plaintext password in configuration file. |
Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,30 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<Context>
3-
<!-- BAD: Password of datasource is not encrypted -->
4-
<Resource name="jdbc/exampleDS1" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="1234" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example1.com:3306/proj" />
3+
<!-- BAD: Password of datasource is in not encrypted -->
4+
<Resource name="jdbc/exampleDS1" auth="Container" type="javax.sql.DataSource"
5+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
6+
username="root" password="1234"
7+
driverClassName="com.mysql.jdbc.Driver"
8+
url="jdbc:mysql://www.example1.com:3306/proj"/>
59

6-
<!-- GOOD: Password is encrypted and stored in a password vault -->
7-
<Resource name="jdbc/exampleDS2" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="${VAULT::exampleDS2::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example2.com:3306/proj" />
10+
<!-- GOOD: Password is encrypted and stored in a password vault -->
11+
<Resource name="jdbc/exampleDS2" auth="Container" type="javax.sql.DataSource"
12+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
13+
username="root" password="${VAULT::exampleDS2::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}"
14+
driverClassName="com.mysql.jdbc.Driver"
15+
url="jdbc:mysql://www.example2.com:3306/proj"/>
816

9-
<!-- GOOD: Password is not stored in the configuration file -->
10-
<Resource name="jdbc/exampleDS3" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="${jdbc.password}" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example3.com:3306/proj" />
17+
<!-- GOOD: Password is not stored in the configuration file -->
18+
<Resource name="jdbc/exampleDS3" auth="Container" type="javax.sql.DataSource"
19+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
20+
username="root" password="${jdbc.password}"
21+
driverClassName="com.mysql.jdbc.Driver"
22+
url="jdbc:mysql://www.example3.com:3306/proj"/>
1123

12-
<!-- GOOD: Password is encrypted -->
13-
<Resource name="jdbc/exampleDS4" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="Tg2Nn7wUZOQ6Xc+1lenkZTQ9ZDf9a2/RBRiqJBCIX6o=" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example4.com:3306/proj" />
14-
15-
</Context>
24+
<!-- GOOD: Password is encrypted -->
25+
<Resource name="jdbc/exampleDS4" auth="Container" type="javax.sql.DataSource"
26+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
27+
username="root" password="Tg2Nn7wUZOQ6Xc+1lenkZTQ9ZDf9a2/RBRiqJBCIX6o="
28+
driverClassName="com.mysql.jdbc.Driver"
29+
url="jdbc:mysql://www.example4.com:3306/proj"/>
30+
</Context>

0 commit comments

Comments
 (0)