hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add a change note and reset the qhelp file

Browse Source
This commit is contained in:
luchua-bc
2021-05-12 15:50:40 +00:00
parent fc7d340a89
commit 4d014717b6
2 changed files with 3 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/change-notes/2021-05-12-hardcoded-azure-credentials-in-api-call.md Normal file
View File

@@ -0,0 +1,3 @@
lgtm,codescanning
* The query "Hard-coded credential in API call" (`java/hardcoded-credential-api-call`)
now recognizes hard-coded authentication credentials with Azure SDK for Java.

30
java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.qhelp
View File

@@ -32,28 +32,6 @@
Instead, the user name and password could be supplied through environment variables, Instead, the user name and password could be supplied through environment variables,
which can be set externally without hard-coding credentials in the source code. which can be set externally without hard-coding credentials in the source code.
</p> </p>
<p>
The following code example connects to AWS using a hard-coded access key ID and secret key:
</p>
<sample src="HardcodedAWSCredentials.java"/>
<p>
Instead, the access key ID and secret key could be supplied through environment variables,
which can be set externally without hard-coding credentials in the source code.
</p>
<p>
The following code example connects to Azure using a hard-coded user name and password or client secret:
</p>
<sample src="HardcodedAzureCredentials.java"/>
<p>
Instead, the username and password or client secret could be supplied through environment variables,
which can be set externally without hard-coding credentials in the source code.
</p>
</example> </example>
<references> <references>
@@ -61,14 +39,6 @@
OWASP: OWASP:
<a href="https://www.owasp.org/index.php/Use_of_hard-coded_password">Use of hard-coded password</a>. <a href="https://www.owasp.org/index.php/Use_of_hard-coded_password">Use of hard-coded password</a>.
</li> </li>
<li>
Microsoft:
<a href="https://docs.microsoft.com/en-us/azure/developer/java/sdk/identity-user-auth#username-password-credential">Azure authentication with user credentials</a>.
</li>
<li>
Amazon:
<a href="https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html">Working with AWS Credentials</a>.
</li>
</references> </references>
</qhelp> </qhelp>