SV.PASSWD.PLAIN

This error occurs when a string can be traced from file storage or the network to the method that uses it as a password.

As of release 2023.2, this checker supports Jakarta EE.

Vulnerability and risk

If the storage or network is not protected by external encryption, anyone who can access it will be able to see the password's meaning.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Passwords should be entered dynamically. If that is not possible, they should be stored as irreversible digest, such as md5. If methods require a password in plain text, store an encrypted password in the configuration file.

Example 1

Copy

13
14
15
16
17
18
19
    public static void main(String[] args) throws Exception {
         Properties info = new Properties();
         final FileInputStream st = new FileInputStream("config.ini");
         info.load(st);
         st.close();
         DriverManager.getConnection("jdbc:mysql://localhost:3307", info);
     }

SV.PASSWD.PLAIN is reported for line 18: password used at the call to 'getConnection' was obtained from 'info'. This password is stored or transmitted in plain-text, unless external encryption is applied (such as SSL).

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Insufficiently Protected Credentials Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.