Skip to content

Commit 3dab09a

Browse files
tomasz-tylenda-sonarsourcetomasz-tylenda-sonarsource
authored
SONARJAVA-6127 Update rule metadata (#5462)
1 parent 207cac2 commit 3dab09a

5 files changed

Lines changed: 38 additions & 63 deletions

File tree

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.html‎

Lines changed: 15 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,39 @@
1-
<p>Because it is easy to extract strings from an application source code or binary, passwords should not be hard-coded. This is particularly true for
2-
applications that are distributed or that are open-source.</p>
1+
<h2>Why is this an issue?</h2>
2+
<p>Hard-coding credentials in source code or binaries makes it easy for attackers to extract sensitive information, especially in distributed or
3+
open-source applications. This practice exposes your application to significant security risks.</p>
4+
<p>This rule flags instances of hard-coded credentials used in database and LDAP connections. It looks for hard-coded credentials in connection
5+
strings, and for variable names that match any of the patterns from the provided list.</p>
36
<p>In the past, it has led to the following vulnerabilities:</p>
47
<ul>
58
<li> <a href="https://www.cve.org/CVERecord?id=CVE-2019-13466">CVE-2019-13466</a> </li>
69
<li> <a href="https://www.cve.org/CVERecord?id=CVE-2018-15389">CVE-2018-15389</a> </li>
710
</ul>
8-
<p>Passwords should be stored outside of the code in a configuration file, a database, or a password management service.</p>
9-
<p>This rule flags instances of hard-coded passwords used in database and LDAP connections. It looks for hard-coded passwords in connection strings,
10-
and for variable names that match any of the patterns from the provided list.</p>
11-
<h2>Ask Yourself Whether</h2>
12-
<ul>
13-
<li> The password allows access to a sensitive component like a database, a file storage, an API, or a service. </li>
14-
<li> The password is used in production environments. </li>
15-
<li> Application re-distribution is required before updating the password. </li>
16-
</ul>
17-
<p>There would be a risk if you answered yes to any of those questions.</p>
18-
<h2>Recommended Secure Coding Practices</h2>
19-
<ul>
20-
<li> Store the credentials in a configuration file that is not pushed to the code repository. </li>
21-
<li> Store the credentials in a database. </li>
22-
<li> Use your cloud provider’s service for managing secrets. </li>
23-
<li> If a password has been disclosed through the source code: change it. </li>
24-
</ul>
25-
<h2>Sensitive Code Example</h2>
26-
<pre>
11+
<h2>How to fix it</h2>
12+
<p>Credentials should be stored in a configuration file that is not committed to the code repository, in a database, or managed by your cloud
13+
provider’s secrets management service. If a password is exposed in the source code, it must be changed immediately.</p>
14+
<h3>Code Examples</h3>
15+
<h4>Noncompliant code example</h4>
16+
<pre data-diff-id="1" data-diff-type="noncompliant">
2717
String username = "steve";
2818
String password = "blue";
2919
Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/test?" +
30-
"user=" + username + "&amp;password=" + password); // Sensitive
20+
"user=" + username + "&amp;password=" + password); // Noncompliant
3121
</pre>
32-
<h2>Compliant Solution</h2>
33-
<pre>
22+
<h4>Compliant solution</h4>
23+
<pre data-diff-id="1" data-diff-type="compliant">
3424
String username = getEncryptedUser();
3525
String password = getEncryptedPassword();
3626
Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/test?" +
3727
"user=" + username + "&amp;password=" + password);
3828
</pre>
39-
<h2>See</h2>
29+
<h2>Resources</h2>
4030
<ul>
4131
<li> OWASP - <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/">Top 10 2021 Category A7 - Identification and
4232
Authentication Failures</a> </li>
4333
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication">Top 10 2017 Category A2 - Broken Authentication</a>
4434
</li>
4535
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/798">CWE-798 - Use of Hard-coded Credentials</a> </li>
4636
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/259">CWE-259 - Use of Hard-coded Password</a> </li>
47-
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/OjdGBQ">CERT, MSC03-J.</a> - Never hard code sensitive information </li>
4837
<li> Derived from FindSecBugs rule <a href="https://h3xstream.github.io/find-sec-bugs/bugs.htm#HARD_CODE_PASSWORD">Hard Coded Password</a> </li>
4938
</ul>
5039

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"title": "Hard-coded passwords are security-sensitive",
3-
"type": "SECURITY_HOTSPOT",
2+
"title": "Credentials should not be hard-coded",
3+
"type": "VULNERABILITY",
44
"code": {
55
"impacts": {
66
"SECURITY": "BLOCKER"
@@ -12,6 +12,7 @@
1212
"func": "Constant\/Issue",
1313
"constantCost": "30min"
1414
},
15+
"quickfix": "infeasible",
1516
"tags": [
1617
"cwe",
1718
"cert"
@@ -45,6 +46,5 @@
4546
"3.5.2",
4647
"6.4.1"
4748
]
48-
},
49-
"quickfix": "unknown"
49+
}
5050
}

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html‎

Lines changed: 13 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,24 @@
1-
<p>Because it is easy to extract strings from an application source code or binary, secrets should not be hard-coded. This is particularly true for
2-
applications that are distributed or that are open-source.</p>
3-
<p>In the past, it has led to the following vulnerabilities:</p>
4-
<ul>
5-
<li> <a href="https://www.cve.org/CVERecord?id=CVE-2022-25510">CVE-2022-25510</a> </li>
6-
<li> <a href="https://www.cve.org/CVERecord?id=CVE-2021-42635">CVE-2021-42635</a> </li>
7-
</ul>
8-
<p>Secrets should be stored outside of the source code in a configuration file or a management service for secrets.</p>
1+
<h2>Why is this an issue?</h2>
2+
<p>Hard-coding secrets in source code or binaries makes it easy for attackers to extract sensitive information, especially in distributed or
3+
open-source applications. This practice exposes credentials and tokens, increasing the risk of unauthorized access and data breaches.</p>
94
<p>This rule detects variables/fields having a name matching a list of words (secret, token, credential, auth, api[_.-]?key) being assigned a
105
pseudorandom hard-coded value. The pseudorandomness of the hard-coded value is based on its entropy and the probability to be human-readable. The
116
randomness sensibility can be adjusted if needed. Lower values will detect less random values, raising potentially more false positives.</p>
12-
<h2>Ask Yourself Whether</h2>
13-
<ul>
14-
<li> The secret allows access to a sensitive component like a database, a file storage, an API, or a service. </li>
15-
<li> The secret is used in a production environment. </li>
16-
<li> Application re-distribution is required before updating the secret. </li>
17-
</ul>
18-
<p>There would be a risk if you answered yes to any of those questions.</p>
19-
<h2>Recommended Secure Coding Practices</h2>
20-
<ul>
21-
<li> Store the secret in a configuration file that is not pushed to the code repository. </li>
22-
<li> Use your cloud provider’s service for managing secrets. </li>
23-
<li> If a secret has been disclosed through the source code: revoke it and create a new one. </li>
24-
</ul>
25-
<h2>Sensitive Code Example</h2>
26-
<pre>
7+
<h2>How to fix it</h2>
8+
<p>Secrets should be stored in a configuration file that is not committed to the code repository, in a database, or managed by your cloud provider’s
9+
secrets management service. If a secret is exposed in the source code, it must be rotated immediately.</p>
10+
<h3>Code Examples</h3>
11+
<h4>Noncompliant code example</h4>
12+
<pre data-diff-id="1" data-diff-type="noncompliant">
2713
private static final String MY_SECRET = "47828a8dd77ee1eb9dde2d5e93cb221ce8c32b37";
2814

2915
public static void main(String[] args) {
3016
MyClass.callMyService(MY_SECRET);
3117
}
3218
</pre>
33-
<h2>Compliant Solution</h2>
19+
<h4>Compliant solution</h4>
3420
<p>Using <a href="https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/secrets-manager">AWS Secrets Manager</a>:</p>
35-
<pre>
21+
<pre data-diff-id="1" data-diff-type="compliant">
3622
import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueRequest;
3723
import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueResponse;
3824

@@ -80,15 +66,15 @@ <h2>Compliant Solution</h2>
8066
MyClass.callMyService(secret);
8167
}
8268
</pre>
83-
<h2>See</h2>
69+
<h2>Resources</h2>
8470
<ul>
8571
<li> OWASP - <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/">Top 10 2021 Category A7 - Identification and
8672
Authentication Failures</a> </li>
8773
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication">Top 10 2017 Category A2 - Broken Authentication</a>
8874
</li>
8975
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/798">CWE-798 - Use of Hard-coded Credentials</a> </li>
76+
<li> MSC - <a href="https://wiki.sei.cmu.edu/confluence/x/OjdGBQ">MSC03-J - Never hard code sensitive information</a> </li>
9077
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m1-improper-credential-usage.html">Mobile Top 10 2024 Category M1 -
9178
Improper Credential Usage</a> </li>
92-
<li> MSC - <a href="https://wiki.sei.cmu.edu/confluence/x/OjdGBQ">MSC03-J - Never hard code sensitive information</a> </li>
9379
</ul>
9480

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"title": "Hard-coded secrets are security-sensitive",
3-
"type": "SECURITY_HOTSPOT",
2+
"title": "Secrets should not be hard-coded",
3+
"type": "VULNERABILITY",
44
"code": {
55
"impacts": {
66
"SECURITY": "BLOCKER"
@@ -12,6 +12,7 @@
1212
"func": "Constant\/Issue",
1313
"constantCost": "30min"
1414
},
15+
"quickfix": "infeasible",
1516
"tags": [
1617
"cwe",
1718
"cert"
@@ -47,6 +48,5 @@
4748
"3.5.2",
4849
"6.4.1"
4950
]
50-
},
51-
"quickfix": "unknown"
51+
}
5252
}

‎sonarpedia.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
"languages": [
44
"JAVA"
55
],
6-
"latest-update": "2026-02-10T09:09:57.194517400Z",
6+
"latest-update": "2026-02-13T15:26:51.447713Z",
77
"options": {
88
"no-language-in-filenames": true,
99
"preserve-filenames": false
1010
}
11-
}
11+
}

0 commit comments

Comments
 (0)