mirror of
https://github.com/github/codeql.git
synced 2026-03-01 05:13:41 +01:00
Specifically Apache sshd defines its sensitive api calls on an inherited interface, and they need to be described that way for us to pick them up.
11 lines
673 B
Java
11 lines
673 B
Java
import com.sshtools.j2ssh.authentication.SshAuthenticationClient;
|
|
import com.sshtools.j2ssh.authentication.PasswordAuthenticationClient;
|
|
|
|
public class HardcodedJ2sshCredentials {
|
|
public static void main(SshAuthenticationClient client1, PasswordAuthenticationClient client2) {
|
|
// BAD: Hardcoded credentials used for the session username and/or password.
|
|
client1.setUsername("Username"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
client2.setUsername("Username"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
client2.setPassword("password"); // $ HardcodedCredentialsApiCall $ HardcodedCredentialsSourceCall
|
|
}
|
|
} |