org.sonar.l10n.java.rules.squid.S1313.html Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of java-checks Show documentation

There is a newer version: 8.6.0.37351

Hardcoding an IP address into source code is a bad idea for several reasons:

 a recompile is required if the address changes
 it forces the same address to be used in every environment (dev, sys, qa, prod)
 it places the responsibility of setting the value to use in production on the shoulders of the developer
 it allows attackers to decompile the code and thereby discover a potentially sensitive address

Noncompliant Code Example

String ip = "127.0.0.1";
Socket socket = new Socket(ip, 6667);

Compliant Solution

String ip = System.getProperty("myapplication.ip");
Socket socket = new Socket(ip, 6667);

See


 CERT, MSC03-J - Never hard code sensitive information