Because it is easy to extract strings from an application source code or binary, credentials should not be hard-coded. This is particularly true
for applications that are distributed or that are open-source.
In the past, it has led to the following vulnerabilities:
Credentials should be stored outside of the code in a configuration file, a database, or a management service for secrets.
This rule flags instances of hard-coded credentials used in database and LDAP connections. It looks for hard-coded credentials in connection
strings, and for variable names that match any of the patterns from the provided list.
It’s recommended to customize the configuration of this rule with additional credential words such as "oauthToken", "secret", …
Ask Yourself Whether
- Credentials allow access to a sensitive component like a database, a file storage, an API or a service.
- Credentials are used in production environments.
- Application re-distribution is required before updating the credentials.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
- Store the credentials in a configuration file that is not pushed to the code repository.
- Store the credentials in a database.
- Use your cloud provider’s service for managing secrets.
- If a password has been disclosed through the source code: change it.
Exceptions
- The rule ignores string literals that are used directly in Regexp methods.
Sensitive Code Example
func connect() {
user := "root"
password:= "supersecret" // Sensitive
url := "login=" + user + "&passwd=" + password
}
Compliant Solution
func connect() {
user := getEncryptedUser()
password:= getEncryptedPass() // Compliant
url := "login=" + user + "&passwd=" + password
}
See
