codeql/java/ql/lib/semmle/code/java/security/HardcodedCredentialsComparison.qll

/**
 * Provides classes and predicates to detect comparing a parameter to a hard-coded credential.
 */

import HardcodedCredentials

/**
 * A call to a method that is or overrides `java.lang.Object.equals`.
 */
class EqualsAccess extends MethodAccess {
  EqualsAccess() { getMethod() instanceof EqualsMethod }
}

/**
 * Holds if `sink` compares password `p` against a hardcoded expression `source`.
 */
predicate isHardcodedCredentialsComparison(
  EqualsAccess sink, HardcodedExpr source, PasswordVariable p
) {
  source = sink.getQualifier() and
  p.getAnAccess() = sink.getArgument(0)
  or
  source = sink.getArgument(0) and
  p.getAnAccess() = sink.getQualifier()
}