Hard coding sensitive information, such as passwords, server IP addresses, and encryption keys can expose the information to attackers. Anyone who has access to the class files can decompile them and discover the sensitive information. Leaking data protected by International Traffic in Arms Regulations (ITAR) or the Health Insurance Portability and Accountability Act (HIPAA) can also have legal consequences. Consequently, programs must not hard code sensitive information.
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MSC03-J | High | Probable | Medium | P12 | L1 |
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| JAVA.HARDCODED.PASSWD | Hardcoded Password (Java) | ||||||
| Coverity | 7.5 | HARDCODED_CREDENTIALS | Implemented | ||||||
| Fortify | 1.0 | Password_Management | Partially implemented | ||||||
| Parasoft Jtest |
| CERT.MSC03.HCCS CERT.MSC03.HCCK CERT.MSC03.AHCA | Avoid passing hardcoded usernames/passwords/URLs to database connection methods Avoid using hard-coded cryptographic keys Avoid hard-coding the arguments to certain methods | ||||||
| PMD | 1.0 | AvoidUsingHardCodedIP | Partially implemented | ||||||
| SonarQube |
| S1313 S2068 | Partially implemented |
...
MSC18-C. Be careful while handling sensitive data, such as passwords, in program code | |
| ISO/IEC TR 24772:2010 | Hard-coded Password [XYP] |
CWE-259, Use of Hard-Coded Password |
...