org.sonar.l10n.py.rules.python.S2068.html Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of python-checks Show documentation

There is a newer version: 4.23.0.17664

Because it is easy to extract strings from an application source code or binary, credentials should not be hard-coded. This is particularly true
for applications that are distributed or that are open-source.
In the past, it has led to the following vulnerabilities:

   CVE-2019-13466 
   CVE-2018-15389 

Credentials should be stored outside of the code in a configuration file, a database, or a management service for secrets.
This rule flags instances of hard-coded credentials used in database and LDAP connections. It looks for hard-coded credentials in connection
strings, and for variable names that match any of the patterns from the provided list.
Ask Yourself Whether

   Credentials allow access to a sensitive component like a database, a file storage, an API or a service. 
   Credentials are used in production environments. 
   Application re-distribution is required before updating the credentials. 

There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices

   Store the credentials in a configuration file that is not pushed to the code repository. 
   Store the credentials in a database. 
   Use your cloud provider’s service for managing secrets. 
   If a password has been disclosed through the source code: change it. 

Sensitive Code Example
username = 'admin'
password = 'admin' # Sensitive
usernamePassword = 'user=admin&password=admin' # Sensitive

Compliant Solution
import os

username = os.getenv("username") # Compliant
password = os.getenv("password") # Compliant
usernamePassword = 'user=%s&password=%s' % (username, password) # Compliant{code}

See

   OWASP - Top 10 2021 Category A7 - Identification and
  Authentication Failures 
   OWASP - Top 10 2017 Category A2 - Broken Authentication
  
   CWE - CWE-798 - Use of Hard-coded Credentials 
   CWE - CWE-259 - Use of Hard-coded Password 
   Derived from FindSecBugs rule Hard Coded Password