Hard coding sensitive information, such as passwords or encryption keys can expose the information to attackers. Anyone who has access to the executable or dynamic library files can examine them for strings or other critical data, revealing the sensitive information. Leaking data protected by International Traffic in Arms Regulations (ITAR) or the Health Insurance Portability and Accountability Act (HIPAA) can also have legal consequences. Consequently, programs must not hard code sensitive information.
Hard coding sensitive information also increases the need to manage and accommodate changes to the code. For example, changing a hard-coded password in a deployed program may require distribution of a patch [Chess 2007].
Noncompliant Code Example (Hard-Coded Database Password)
This noncompliant code example must authenticate to a remote service with a code, using the
authenticate() function declared below. It passes the authentication code to this function as a string literal.
The authentication code exists in the program's binary executable and can be easily discovered.
Implementation Details (Unix)
Many Unix platforms provide a
strings utility that prints out all of the ASCII strings in a binary file. Here is the output of running
strings on this program, on an Ubuntu 16.04 platform:
This compliant solution requires the user to supply the authentication code, and securely erases it when done, using
memset_s(), an optional function provided by C11's Annex K.
Alternatively, the program could read the authentication code from a file, letting file system security protect the file and the code from untrusted users.
Hard coding sensitive information exposes that information to attackers. The severity of this rule can vary depending on the kind of information that is disclosed. Frequently, the information disclosed is password or key information, which can lead to remote exploitation. Consequently, a high severity rating is given but may be adjusted downwards according to the nature of the sensitive data.
Hardcoded DNS Name
Hardcoded Crypto Key
Hardcoded Crypto Salt
Hardcoded Seed in PRNG
Do not hard code string literals
Assistance provided: reports when a literal is provided as an argument to a function parameter with the ‘noliteral’ argument Semantic; several Windows API functions are marked as such and the ‘-sem’ option can apply it to other functions as appropriate
|Polyspace Bug Finder|
|CERT C: Rule MSC41-C||Checks for hard coded sensitive data (rule partially covered)|
|SEI CERT Oracle Coding Standard for Java||MSC03-J. Never hard code sensitive information|
Hard-coded Password [XYP]
Section 11.2, "Outbound Passwords: Keep Passwords out of Source Code"
"Unsafe Mobile Code: Database Access"