Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Passwords should be entered dynamically. If that is not possible, they should be stored as irreversible digest, such as md5. If methods require a password in plain text, store an encrypted password in the configuration file.

Example 1

13    public static void main(String[] args) throws Exception {
14         Properties info = new Properties();
15         final FileInputStream st = new FileInputStream("config.ini");
16         info.load(st);
17         st.close();
18         DriverManager.getConnection("jdbc:mysql://localhost:3307", info);
19     }

SV.PASSWD.PLAIN is reported for line 18: password used at the call to 'getConnection' was obtained from 'info'. This password is stored or transmitted in plain-text, unless external encryption is applied (such as SSL).

Security guidelines

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.