Skip to content

Commit e87fd86

Browse files
smowtonsmowton
authored
Merge pull request github#4814 from luchua-bc/java/password-in-configuration
Java: Password in Java EE configuration files
2 parents a5e28ac + bfb138d commit e87fd86

File tree

8 files changed

+181
-0
lines changed

8 files changed

+181
-0
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.qhelp

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
<overview>
4+
<p>
5+
Storing a plaintext password in a configuration file allows anyone who can read the file to access the password-protected resources.
6+
</p>
7+
</overview>
8+
9+
<recommendation>
10+
<p>
11+
Passwords stored in configuration files should be encrypted. Utilities provided by application servers like keystore and password vault can be used to encrypt and manage passwords.
12+
</p>
13+
</recommendation>
14+
15+
<example>
16+
<p>
17+
In the first example, the password of a datasource configuration is stored in cleartext in the context.xml file of a Java EE application.
18+
</p>
19+
20+
<p>
21+
In the second example, the password of a datasource configuration is encrypted and managed by a password vault.
22+
</p>
23+
<sample src="context.xml" />
24+
</example>
25+
26+
<references>
27+
<li>
28+
CWE:
29+
<a href="https://cwe.mitre.org/data/definitions/555.html">CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File</a>
30+
</li>
31+
<li>
32+
RedHat Security Guide:
33+
<a href="https://access.redhat.com/documentation/en-us/jboss_enterprise_application_platform/6.1/html/security_guide/Store_and_Retrieve_Encrypted_Sensitive_Strings_in_the_Java_Keystore">Store and Retrieve Encrypted Sensitive Strings in the Java Keystore</a>
34+
</li>
35+
<li>
36+
SonarSource:
37+
<a href="https://rules.sonarsource.com/java/RSPEC-2068">Hard-coded credentials are security-sensitive</a>
38+
</li>
39+
</references>
40+
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
/**
2+
* @name Password in configuration file
3+
* @description Finds passwords in configuration files.
4+
* @kind problem
5+
* @id java/password-in-configuration
6+
* @tags security
7+
* external/cwe/cwe-555
8+
* external/cwe/cwe-256
9+
* external/cwe/cwe-260
10+
*/
11+
12+
import java
13+
14+
/** Holds if the attribute value is not a cleartext password */
15+
bindingset[value]
16+
predicate isNotPassword(string value) {
17+
value = "" // Empty string
18+
or
19+
value.regexpMatch("\\$\\{.*\\}") // Variable placeholder ${password}
20+
or
21+
value.matches("%=") // A basic check of encrypted passwords ending with padding characters, which could be improved to be more accurate.
22+
}
23+
24+
/** Holds if the attribute value has an embedded password */
25+
bindingset[value]
26+
predicate hasEmbeddedPassword(string value) {
27+
exists(string password |
28+
password = value.regexpCapture("(?is).*(pwd|password)\\s*=([^;:,]*).*", 2).trim() and
29+
not isNotPassword(password)
30+
)
31+
}
32+
33+
from XMLAttribute nameAttr
34+
where
35+
nameAttr.getName().toLowerCase() in ["password", "pwd"] and
36+
not isNotPassword(nameAttr.getValue().trim()) // Attribute name "password" or "pwd"
37+
or
38+
exists(
39+
XMLAttribute valueAttr // name/value pair like <property name="password" value="mysecret"/>
40+
|
41+
valueAttr.getElement() = nameAttr.getElement() and
42+
nameAttr.getName().toLowerCase() = "name" and
43+
nameAttr.getValue().toLowerCase() in ["password", "pwd"] and
44+
valueAttr.getName().toLowerCase() = "value" and
45+
not isNotPassword(valueAttr.getValue().trim())
46+
)
47+
or
48+
hasEmbeddedPassword(nameAttr.getValue().trim()) // Attribute value matches password pattern
49+
select nameAttr, "Plaintext password in configuration file."

‎java/ql/src/experimental/Security/CWE/CWE-555/context.xml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<Context>
3+
<!-- BAD: Password of datasource is not encrypted -->
4+
<Resource name="jdbc/exampleDS" auth="Container" type="javax.sql.DataSource"
5+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
6+
username="root" password="1234"
7+
driverClassName="com.mysql.jdbc.Driver"
8+
url="jdbc:mysql://www.example.com:3306/proj"/>
9+
10+
<!-- GOOD: Password is encrypted and stored in a password vault -->
11+
<Resource name="jdbc/exampleDS" auth="Container" type="javax.sql.DataSource"
12+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
13+
username="root" password="${VAULT::exampleDS::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}"
14+
driverClassName="com.mysql.jdbc.Driver"
15+
url="jdbc:mysql://www.example.com:3306/proj"/>
16+
17+
</Context>

‎java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| applicationContext.xml:9:3:9:48 | name=password | Plaintext password in configuration file. |
2+
| context.xml:4:2:8:50 | password=1234 | Plaintext password in configuration file. |
3+
| custom-config.xml:3:2:3:137 | value=server=myoracle.example.com;port=1521;database=testdb;username=root;password=test1234 | Plaintext password in configuration file. |

‎java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql

‎java/ql/test/experimental/query-tests/security/CWE-555/applicationContext.xml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans
3+
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd">
4+
5+
<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">
6+
<property name="driverClassName" value="com.mysql.jdbc.Driver" />
7+
<property name="url" value="jdbc:mysql://www.example.com:3306/test" />
8+
<property name="username" value="root" />
9+
<property name="password" value="mysecret" />
10+
<property name="initialSize" value="30" />
11+
12+
<property name="maxActive" value="500" />
13+
<property name="maxIdle" value="2" />
14+
<property name="minIdle" value="1" />
15+
</bean>
16+
17+
<bean id="sessionFactory" class="org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean">
18+
<property name="dataSource" ref="dataSource" />
19+
20+
<property name="annotatedClasses">
21+
<list>
22+
<value>com.example.entity.Users</value>
23+
</list>
24+
</property>
25+
26+
<property name="hibernateProperties">
27+
<value>
28+
hibernate.dialect=org.hibernate.dialect.MySQLDialect
29+
hibernate.hbm2ddl.auto=update
30+
hibernate.show_sql=true
31+
hibernate.cache.use_second_level_cache=false
32+
hibernate.cache.provider_class=org.hibernate.cache.internal.NoCacheProvider
33+
hibernate.generate_statistics=true
34+
</value>
35+
</property>
36+
</bean>
37+
</beans>

‎java/ql/test/experimental/query-tests/security/CWE-555/context.xml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<Context>
3+
<!-- BAD: Password of datasource is in not encrypted -->
4+
<Resource name="jdbc/exampleDS1" auth="Container" type="javax.sql.DataSource"
5+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
6+
username="root" password="1234"
7+
driverClassName="com.mysql.jdbc.Driver"
8+
url="jdbc:mysql://www.example1.com:3306/proj"/>
9+
10+
<!-- GOOD: Password is encrypted and stored in a password vault -->
11+
<Resource name="jdbc/exampleDS2" auth="Container" type="javax.sql.DataSource"
12+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
13+
username="root" password="${VAULT::exampleDS2::password::N2NhZDYzOTMtNWE0OS00ZGQ0LWE4MmEtMWNlMDMyNDdmNmI2TElORV9CUkVBS3ZhdWx0}"
14+
driverClassName="com.mysql.jdbc.Driver"
15+
url="jdbc:mysql://www.example2.com:3306/proj"/>
16+
17+
<!-- GOOD: Password is not stored in the configuration file -->
18+
<Resource name="jdbc/exampleDS3" auth="Container" type="javax.sql.DataSource"
19+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
20+
username="root" password="${jdbc.password}"
21+
driverClassName="com.mysql.jdbc.Driver"
22+
url="jdbc:mysql://www.example3.com:3306/proj"/>
23+
24+
<!-- GOOD: Password is encrypted -->
25+
<Resource name="jdbc/exampleDS4" auth="Container" type="javax.sql.DataSource"
26+
maxTotal="100" maxIdle="30" maxWaitMillis="10000"
27+
username="root" password="Tg2Nn7wUZOQ6Xc+1lenkZTQ9ZDf9a2/RBRiqJBCIX6o="
28+
driverClassName="com.mysql.jdbc.Driver"
29+
url="jdbc:mysql://www.example4.com:3306/proj"/>
30+
</Context>

‎java/ql/test/experimental/query-tests/security/CWE-555/custom-config.xml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<db-connections>
3+
<db-connection name="oracleServerConn" value="server=myoracle.example.com;port=1521;database=testdb;username=root;password=test1234" />
4+
</db-connections>

0 commit comments

Comments
 (0)