hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Additional hardcoded credentials candidates 3rd-party api calls

Browse Source
This commit is contained in:
Daniel Santos
2021-09-17 19:01:00 -05:00
committed by Chris Smowton
parent 1d56330baa
commit 60e0f09586
1 changed files with 44 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
java/ql/src/Security/CWE/CWE-798/SensitiveApi.qll
View File

@@ -438,6 +438,49 @@ private predicate otherApiCallableCredentialParam(string s) {
"com.azure.identity.UsernamePasswordCredentialBuilder;username(String);0",
"com.azure.identity.UsernamePasswordCredentialBuilder;password(String);0",
"com.azure.identity.ClientSecretCredentialBuilder;clientSecret(String);0",
"org.apache.shiro.mgt.AbstractRememberMeManager;setCipherKey(byte[]);0"
"org.apache.shiro.mgt.AbstractRememberMeManager;setCipherKey(byte[]);0",
"com.jcraft.jsch.JSch;getSession(String, String, int);0",
"com.jcraft.jsch.JSch;getSession(String, String);0",
"ch.ethz.ssh2.Connection;authenticateWithPassword(String, String);0",
"org.apache.sshd.client.SshClient;connect(String, String, int);0",
"org.apache.sshd.client.SshClient;connect(String, SocketAddress);0",
"net.schmizz.sshj.SSHClient;authPassword(String, char[]);0",
"net.schmizz.sshj.SSHClient;authPassword(String, String);0",
"com.sshtools.j2ssh.authentication.SshAuthenticationClient;setUsername(String);0",
"com.sshtools.j2ssh.authentication.PasswordAuthenticationClient;setUsername(String);0",
"com.trilead.ssh2.Connection;authenticateWithPassword(String, String);0",
"com.trilead.ssh2.Connection;authenticateWithDSA(String, String, String);0",
"com.trilead.ssh2.Connection;authenticateWithNone(String);0",
"com.trilead.ssh2.Connection;getRemainingAuthMethods(String);0",
"com.trilead.ssh2.Connection;isAuthMethodAvailable(String, String);0",
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, char[], String);0",
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, File, String);0",
"com.jcraft.jsch.Session;setPassword(byte[]);0",
"com.jcraft.jsch.Session;setPassword(String);0",
"ch.ethz.ssh2.Connection;authenticateWithPassword(String, String);1",
"org.apache.sshd.client.session.AbstractClientSession;addPasswordIdentity(String);0",
"net.schmizz.sshj.SSHClient;authPassword(String, char[]);1",
"net.schmizz.sshj.SSHClient;authPassword(String, String);1",
"com.sshtools.j2ssh.authentication.PasswordAuthenticationClient;setPassword(String);0",
"com.trilead.ssh2.Connection;authenticateWithPassword(String, String);1",
"com.trilead.ssh2.Connection;authenticateWithDSA(String, String, String);2",
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, char[], String);2",
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, File, String);2",
"com.trilead.ssh2.Connection;authenticateWithDSA(String, String, String);1",
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, char[], String);1",
"org.apache.commons.net.ftp.FTPClient;login(String, String);0",
"org.apache.commons.net.ftp.FTPClient;login(String, String, String);0",
"org.apache.commons.net.ftp.FTPClient;login(String, String);1",
"org.apache.commons.net.ftp.FTPClient;login(String, String, String);1",
"com.mongodb.MongoCredential;createCredential(String, String, char[]);0",
"com.mongodb.MongoCredential;createMongoCRCredential(String, String, char[]);0",
"com.mongodb.MongoCredential;createPlainCredential(String, String, char[]);0",
"com.mongodb.MongoCredential;createScramSha1Credential(String, String, char[]);0",
"com.mongodb.MongoCredential;createGSSAPICredential(String);0",
"com.mongodb.MongoCredential;createMongoX509Credential(String);0",
"com.mongodb.MongoCredential;createCredential(String, String, char[]);2",
"com.mongodb.MongoCredential;createMongoCRCredential(String, String, char[]);2",
"com.mongodb.MongoCredential;createPlainCredential(String, String, char[]);2",
"com.mongodb.MongoCredential;createScramSha1Credential(String, String, char[]);2"
]
}