1    package com.company;
2    import java.io.IOException;
3    import java.io.OutputStream;
4    public class WriteInfo {
5        public void write(OutputStream os, int ssn) throws IOException {
6            os.write(ssn);
7        }
8    }

Klocwork produces a defect when a sensitive value is written to a stream. In this example, a social security number is the sensitive value.

Fixed code example 1

1    package com.company;
2    import java.io.IOException;
3    import java.io.OutputStream;
4    public class WriteInfo {
5        public void write(OutputStream os, int ssn) throws IOException {
6            int encryptedSsn = encrypt(ssn);
7            os.write(encryptedSsn);
8        }
9        private int encrypt(int value) {
10           int encrypted;
11           // ... do encryption
12           return encrypted;
13       }
14   }

Apply the following .jkb file, which tells the Klocwork analysis engine that the ‘encrypt()’ method returns safe data.

1    package com.company;
2    @Bind("SV.SENSITIVE.DATA")
3    class Writer {
4        @Check("return") private int encrypt(int value);
5    }

In this fixed example, the sensitive value (a social security number) is encrypted before being written. Klocwork does not produce a defect in this fixed example.

Vulnerable code example 2

1    package com.company;
2    import java.io.IOException;
3    import java.io.Writer;
4    public class WriteInfo {
5        public void write(Writer w, User user) throws IOException {
6            String value = user.getPassword();
7            w.write(value);
8        }
9        public static class User {
10           public String getPassword() {
11               return "pw";
12           }
13       }
14   }

Klocwork produces a defect when a sensitive value is written to a Writer object. In this example, a password is retrieved from the ‘getPassword()’ method and is then written.

Fixed code example 2

1    package com.company;
2    import java.io.IOException;
3    import java.io.Writer;
4    public class WriteInfo {
5        public void write(Writer w, User user) throws IOException {
6            String encryptedPassword = encrypt(user.getPassword());
7            w.write(encryptedPassword);
8        }
9        private String encrypt(String value) {
10           String encrypted;
11           // ... do encryption
12           return encrypted;
13       }
14       public static class User {
15           public String getPassword() {
16                return "pw";
17           }
18       }
19   }

Apply the following .jkb file, which tell the Klocwork analysis engine that the ‘encrypt()’ method contains safe data.

1    package com.company;
2    @Bind("SV.SENSITIVE.DATA")
3    class Writer {
4        @Check("return") private String encrypt(String value);
5    }

In this fixed example, the sensitive data is encrypted before being written. Also note that the variable name ‘encryptedPassword’ was used to clearly indicate that the code is not storing a plain-text password.

Vulnerable code example with configurable checker

This checker is configured with a default list of sensitive data such as: dob, ssn, password. This list is meant to be configurable, rather than all-inclusive. Sensitive data can be configured using the @CheckerParam annotation in a .jkb file. Please note that the default built-in list of sensitive terms is no longer used once the user specifies a custom @CheckerParam option.

In this example, the user has domain-specific knowledge of their software and has identified that a patient’s ‘name’, ‘dob’, and ‘address’ are sensitive types of data. A .jkb file containing the following annotation has already been loaded into the project’s configuration:

1    @CheckerParam("SV.SENSITIVE.DATA", "name,dob,address")
2
3    package com.company;
4    @Bind("SV.SENSITIVE.DATA")
5    class Writer {
6        @Check("return") public String encrypt(String value);
7    }

The above .jkb file notifies the Klocwork analysis engine that dob, address and name are sensitive values, and that the ‘encrypt()’ method returns safe data.

Vulnerable code example 3

1    package com.company;
2    import java.io.IOException;
3    import java.io.Writer;
4    public class WritePatient {
5        public void writePatientInfo(Writer writer, Patient patient) throws IOException {
6            StringBuilder sb = new StringBuilder();
7            sb.append(patient.getName());
8            sb.append(';');
9            sb.append(patient.getDob());
10           sb.append(';');
11           sb.append(patient.getAddress());
12           writer.write(sb.toString());
13       }
14       public static class Patient {
15           public String getName() { return "John Doe"; }
16           public String getDob() { return "1900-01-01"; }
17           public String getAddress() { return "123 Main St., Cityville, NY 12345"; }
18       }
19   }

Klocwork will detect 3 defects in the above code, one for the unencrypted name, one for the unencrypted date of birth, and one for the unencrypted address.

Fixed code example 3

1    package com.company;
2    import java.io.IOException;
3    import java.io.Writer;
4    public class WritePatient {
5        public void writePatientInfo(Writer writer, Patient patient) throws IOException {
6            StringBuilder sb = new StringBuilder();
7            sb.append(encrypt(patient.getName()));
8            sb.append(';');
9            sb.append(encrypt(patient.getDob()));
10           sb.append(';');
11           sb.append(encrypt(patient.getAddress()));
12           writer.write(sb.toString());
13       }
14       public String encrypt(String value) {
15           String encrypted;
16           // .. do encryption
17           return encrypted;
18       }
19       public static class Patient {
20           public String getName() { return "John Doe"; }
21           public String getDob() { return "1900-01-01"; }
22           public String getAddress() { return "123 Main St., Cityville, NY 12345"; }
23       }
24   }

Related checkers

SV.SENSITIVE.OBJ

External guidance

Extension

This checker can be tuned to look for sensitive values using @CheckerParam and @Check options in a .jkb file. If you tune this checker to add any custom sensitive values, the defaults are no longer used; if you want to include them as well, you can re-add them to your .jkb file along with the custom values. See Tuning Java analysis for more information.

Default sensitive values

The sensitive values used by default are: dob, ssn, pin, password, password_buffer, pwd, pwd_buffer, pwdbuf, passwd.