Files
codeql/java/ql/test/query-tests/security/CWE-798/semmle/tests/CredentialsTest.java
Chris Smowton b62e9dc92c Convert tests to inline expectations and fix one bug revealed doing so
Specifically Apache sshd defines its sensitive api calls on an inherited interface, and they need to be described that way for us to pick them up.
2022-08-13 14:02:05 +01:00

21 lines
638 B
Java

package test.cwe798.cwe.examples;
import java.sql.DriverManager;
import java.sql.SQLException;
public class CredentialsTest {
private static final String p = "123456"; // hard-coded credential (flow source)
public static void main(String[] args) throws SQLException {
String url = "jdbc:mysql://localhost/test";
String u = "admin"; // hard-coded credential (flow source)
DriverManager.getConnection(url, u, p); // $ HardcodedCredentialsApiCall
test(url, u, p);
}
public static void test(String url, String v, String q) throws SQLException {
DriverManager.getConnection(url, v, q); // $ HardcodedCredentialsApiCall
}
}