Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Do not use empty passwords, especially hardcoded ones.

Example 1

13     public static void main(String[] args) throws SQLException {
14         Properties info = new Properties();
15         info.setProperty("user", "root");
16         info.setProperty("password", "");
17         DriverManager.getConnection("jdbc:mysql://localhost:3307", info);
18     }

SV.PASSWD.HC.EMPTY is reported for line 16: empty string is used as a password: leaving an empty password in an application is a major security risk.

Security guidelines

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.