hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 03:36:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3729 from luchua-bc/java-hardcoded-aws-credentials

Browse Source 
Java: Hardcoded AWS credentials
This commit is contained in:
Arthur Baars
2020-07-13 18:04:42 +02:00
committed by GitHub
parent 6519629472 12803f1f53
commit 67b6018079
8 changed files with 177 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/src/Security/CWE/CWE-798/HardcodedAWSCredentials.java Normal file
View File

@@ -0,0 +1,10 @@
import com.amazonaws.auth.AWSCredentials;
import com.amazonaws.auth.BasicAWSCredentials;
public class HardcodedAWSCredentials {
public static void main(String[] args) {
//Hardcoded credentials for connecting to AWS services
//To fix the problem, use other approaches including AWS credentials file, environment variables, or instance/container credentials instead
AWSCredentials creds = new BasicAWSCredentials("ACCESS_KEY", "SECRET_KEY"); //sensitive call
}
}

6
java/ql/src/Security/CWE/CWE-798/SensitiveApi.qll
View File

@@ -129,7 +129,8 @@ private predicate javaApiCallablePasswordParam(string s) {
s = "sun.tools.jconsole.ProxyClient;ProxyClient(String, int, String, String);3" or
s = "sun.tools.jconsole.ProxyClient;getProxyClient(String, int, String, String);3" or
s = "sun.tools.jconsole.ProxyClient;getProxyClient(String, String, String);2" or
s = "sun.tools.jconsole.ProxyClient;getCacheKey(String, int, String, String);3"
s = "sun.tools.jconsole.ProxyClient;getCacheKey(String, int, String, String);3" or
s = "com.amazonaws.auth.BasicAWSCredentials;BasicAWSCredentials(String, String);1"
}
/**
@@ -200,7 +201,8 @@ private predicate javaApiCallableUsernameParam(string s) {
s = "sun.tools.jconsole.ProxyClient;getProxyClient(String, String, String);1" or
s = "sun.tools.jconsole.ProxyClient;getConnectionName(String, String);1" or
s = "sun.tools.jconsole.ProxyClient;getProxyClient(String, int, String, String);2" or
s = "sun.tools.jconsole.ProxyClient;getConnectionName(String, int, String);2"
s = "sun.tools.jconsole.ProxyClient;getConnectionName(String, int, String);2" or
s = "com.amazonaws.auth.BasicAWSCredentials;BasicAWSCredentials(String, String);0"
}
/**