Skip to content

Commit e27ccd0

Browse files
luchua-bcluchua-bc
committed
Format the code and update qldoc
1 parent 7ba2371 commit e27ccd0

File tree

6 files changed

+36
-54
lines changed

6 files changed

+36
-54
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.qhelp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
</li>
3131
<li>
3232
RedHat Security Guide:
33-
<a href="https://access.redhat.com/documentation/en-us/jboss_enterprise_application_platform/6.1/html/security_guide/Store_and_Retrieve_Encrypted_Sensitive_Strings_in_the_Java_Keystore">STORE AND RETRIEVE ENCRYPTED SENSITIVE STRINGS IN THE JAVA KEYSTORE</a>
33+
<a href="https://access.redhat.com/documentation/en-us/jboss_enterprise_application_platform/6.1/html/security_guide/Store_and_Retrieve_Encrypted_Sensitive_Strings_in_the_Java_Keystore">Store and Retrieve Encrypted Sensitive Strings in the Java Keystore</a>
3434
</li>
3535
<li>
3636
SonarSource:

‎java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,4 @@ where
3434
)
3535
or
3636
a.getValue().regexpMatch("(?is).*(pwd|password)\\s*=(?!\\s*;).*") // Attribute value matches password pattern
37-
select a, "Avoid plaintext passwords in configuration files."
37+
select a, "Plaintext passwords in configuration files."

‎java/ql/src/experimental/Security/CWE/CWE-555/context.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<Context>
3-
<!-- BAD: Password of datasource is in not encrypted -->
3+
<!-- BAD: Password of datasource is not encrypted -->
44
<Resource name="jdbc/exampleDS" auth="Container" type="javax.sql.DataSource"
55
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
66
username="root" password="1234"

‎java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
| applicationContext.xml:11:6:11:50 | name=password | Avoid plaintext passwords in configuration files. |
2-
| context.xml:4:5:8:63 | password=1234 | Avoid plaintext passwords in configuration files. |
1+
| applicationContext.xml:9:3:9:48 | name=password | Plaintext passwords in configuration files. |
2+
| context.xml:4:5:4:253 | password=1234 | Plaintext passwords in configuration files. |

‎java/ql/test/experimental/query-tests/security/CWE-555/applicationContext.xml‎

Lines changed: 25 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,37 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<beans xmlns="http://www.springframework.org/schema/beans"
3-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4-
xsi:schemaLocation="http://www.springframework.org/schema/beans
2+
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans
53
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd">
64

7-
<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">
8-
<property name="driverClassName" value="com.mysql.jdbc.Driver"/>
9-
<property name="url" value="jdbc:mysql://www.example.com:3306/test"/>
10-
<property name="username" value="root"/>
11-
<property name="password" value="mysecret"/>
12-
<property name="initialSize" value="30"/>
13-
14-
<property name="maxActive" value="500"/>
15-
<property name="maxIdle" value="2"/>
16-
<property name="minIdle" value="1"/>
17-
</bean>
5+
<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">
6+
<property name="driverClassName" value="com.mysql.jdbc.Driver" />
7+
<property name="url" value="jdbc:mysql://www.example.com:3306/test" />
8+
<property name="username" value="root" />
9+
<property name="password" value="mysecret" />
10+
<property name="initialSize" value="30" />
1811

19-
<bean id="sessionFactory" class="org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean">
20-
<property name="dataSource" ref="dataSource"/>
21-
22-
<property name="annotatedClasses">
23-
<list>
24-
<value>com.example.entity.Users</value>
25-
</list>
26-
</property>
27-
28-
<property name="hibernateProperties">
29-
<value>
12+
<property name="maxActive" value="500" />
13+
<property name="maxIdle" value="2" />
14+
<property name="minIdle" value="1" />
15+
</bean>
16+
17+
<bean id="sessionFactory" class="org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean">
18+
<property name="dataSource" ref="dataSource" />
19+
20+
<property name="annotatedClasses">
21+
<list>
22+
<value>com.example.entity.Users</value>
23+
</list>
24+
</property>
25+
26+
<property name="hibernateProperties">
27+
<value>
3028
hibernate.dialect=org.hibernate.dialect.MySQLDialect
3129
hibernate.hbm2ddl.auto=update
3230
hibernate.show_sql=true
3331
hibernate.cache.use_second_level_cache=false
3432
hibernate.cache.provider_class=org.hibernate.cache.internal.NoCacheProvider
3533
hibernate.generate_statistics=true
3634
</value>
37-
</property>
38-
</bean>
35+
</property>
36+
</bean>
3937
</beans>

‎java/ql/test/experimental/query-tests/security/CWE-555/context.xml‎

Lines changed: 6 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,15 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<Context>
3-
<!-- BAD: Password of datasource is in not encrypted -->
4-
<Resource name="jdbc/exampleDS1" auth="Container" type="javax.sql.DataSource"
5-
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
6-
username="root" password="1234"
7-
driverClassName="com.mysql.jdbc.Driver"
8-
url="jdbc:mysql://www.example1.com:3306/proj"/>
3+
<!-- BAD: Password of datasource is not encrypted -->
4+
<Resource name="jdbc/exampleDS1" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="1234" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example1.com:3306/proj" />
95

106
<!-- GOOD: Password is encrypted and stored in a password vault -->
11-
<Resource name="jdbc/exampleDS2" auth="Container" type="javax.sql.DataSource"
12-
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
13-
username="root" password="${VAULT::exampleDS2::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}"
14-
driverClassName="com.mysql.jdbc.Driver"
15-
url="jdbc:mysql://www.example2.com:3306/proj"/>
7+
<Resource name="jdbc/exampleDS2" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="${VAULT::exampleDS2::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example2.com:3306/proj" />
168

179
<!-- GOOD: Password is not stored in the configuration file -->
18-
<Resource name="jdbc/exampleDS3" auth="Container" type="javax.sql.DataSource"
19-
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
20-
username="root" password="${jdbc.password}"
21-
driverClassName="com.mysql.jdbc.Driver"
22-
url="jdbc:mysql://www.example3.com:3306/proj"/>
10+
<Resource name="jdbc/exampleDS3" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="${jdbc.password}" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example3.com:3306/proj" />
2311

2412
<!-- GOOD: Password is encrypted -->
25-
<Resource name="jdbc/exampleDS4" auth="Container" type="javax.sql.DataSource"
26-
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
27-
username="root" password="Tg2Nn7wUZOQ6Xc+1lenkZTQ9ZDf9a2/RBRiqJBCIX6o="
28-
driverClassName="com.mysql.jdbc.Driver"
29-
url="jdbc:mysql://www.example4.com:3306/proj"/>
30-
13+
<Resource name="jdbc/exampleDS4" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="Tg2Nn7wUZOQ6Xc+1lenkZTQ9ZDf9a2/RBRiqJBCIX6o=" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example4.com:3306/proj" />
14+
3115
</Context>

0 commit comments

Comments
 (0)