hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Format the code and minor text change

Browse Source
This commit is contained in:
luchua-bc
2020-12-13 21:15:18 +00:00
parent e27ccd0a81
commit d469e9b24e
3 changed files with 28 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql
View File

@@ -34,4 +34,4 @@ where
)
or
a.getValue().regexpMatch("(?is).*(pwd|password)\\s*=(?!\\s*;).*") // Attribute value matches password pattern
select a, "Plaintext passwords in configuration files."
select a, "Plaintext password in configuration file."

4
java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected
View File

@@ -1,2 +1,2 @@
| applicationContext.xml:9:3:9:48 | name=password | Plaintext passwords in configuration files. |
| context.xml:4:5:4:253 | password=1234 | Plaintext passwords in configuration files. |
| applicationContext.xml:9:3:9:48 | name=password | Plaintext password in configuration file. |
| context.xml:4:2:8:50 | password=1234 | Plaintext password in configuration file. |

35
java/ql/test/experimental/query-tests/security/CWE-555/context.xml
View File

@@ -1,15 +1,30 @@
<?xml version="1.0" encoding="UTF-8"?>
<Context>
<!-- BAD: Password of datasource is not encrypted -->
<Resource name="jdbc/exampleDS1" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="1234" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example1.com:3306/proj" />
<!-- BAD: Password of datasource is in not encrypted -->
<Resource name="jdbc/exampleDS1" auth="Container" type="javax.sql.DataSource"
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
username="root" password="1234"
driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://www.example1.com:3306/proj"/>
<!-- GOOD: Password is encrypted and stored in a password vault -->
<Resource name="jdbc/exampleDS2" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="${VAULT::exampleDS2::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example2.com:3306/proj" />
<!-- GOOD: Password is encrypted and stored in a password vault -->
<Resource name="jdbc/exampleDS2" auth="Container" type="javax.sql.DataSource"
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
username="root" password="${VAULT::exampleDS2::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}"
driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://www.example2.com:3306/proj"/>
<!-- GOOD: Password is not stored in the configuration file -->
<Resource name="jdbc/exampleDS3" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="${jdbc.password}" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example3.com:3306/proj" />
<!-- GOOD: Password is not stored in the configuration file -->
<Resource name="jdbc/exampleDS3" auth="Container" type="javax.sql.DataSource"
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
username="root" password="${jdbc.password}"
driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://www.example3.com:3306/proj"/>
<!-- GOOD: Password is encrypted -->
<Resource name="jdbc/exampleDS4" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="root" password="Tg2Nn7wUZOQ6Xc+1lenkZTQ9ZDf9a2/RBRiqJBCIX6o=" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://www.example4.com:3306/proj" />
</Context>
<!-- GOOD: Password is encrypted -->
<Resource name="jdbc/exampleDS4" auth="Container" type="javax.sql.DataSource"
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
username="root" password="Tg2Nn7wUZOQ6Xc+1lenkZTQ9ZDf9a2/RBRiqJBCIX6o="
driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://www.example4.com:3306/proj"/>
</Context>