mirror of
https://github.com/github/codeql.git
synced 2026-03-01 05:13:41 +01:00
Specifically Apache sshd defines its sensitive api calls on an inherited interface, and they need to be described that way for us to pick them up.
19 lines
1.2 KiB
Java
19 lines
1.2 KiB
Java
import com.trilead.ssh2.Connection;
|
|
|
|
import java.io.IOException;
|
|
import java.io.File;
|
|
|
|
public class HardcodedTrileadSshCredentials {
|
|
public static void main(Connection conn) {
|
|
// BAD: Hardcoded credentials used for the session username and/or password.
|
|
try {
|
|
conn.authenticateWithPassword("Username", "password"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
conn.authenticateWithDSA("Username", "password", "key"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
conn.authenticateWithNone("Username"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
conn.getRemainingAuthMethods("Username"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
conn.isAuthMethodAvailable("Username", "method"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
conn.authenticateWithPublicKey("Username", "key".toCharArray(), "password"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
conn.authenticateWithPublicKey("Username", (File)null, "password"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
} catch(IOException e) { }
|
|
}
|
|
} |