SV.PASSWD.PLAIN

This error occurs when a string can be traced from file storage or the network to the method that uses it as a password.

As of release 2023.2, this checker supports Jakarta EE.

Vulnerability and risk

If the storage or network is not protected by external encryption, anyone who can access it will be able to see the password's meaning.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Passwords should be entered dynamically. If that is not possible, they should be stored as irreversible digest, such as md5. If methods require a password in plain text, store an encrypted password in the configuration file.

Example 1

13
14
15
16
17
18
19
    public static void main(String[] args) throws Exception {
         Properties info = new Properties();
         final FileInputStream st = new FileInputStream("config.ini");
         info.load(st);
         st.close();
         DriverManager.getConnection("jdbc:mysql://localhost:3307", info);
     }

SV.PASSWD.PLAIN is reported for line 18: password used at the call to 'getConnection' was obtained from 'info'. This password is stored or transmitted in plain-text, unless external encryption is applied (such as SSL).

External guidance

• CERT MSC03-J: Never hard code sensitive information
• CWE-256: Plaintext Storage of a Password
• CWE-259: Use of Hard-coded Password
• CWE-311: Missing Encryption of Sensitive Data
• CWE-522: Insufficiently Protected Credentials
• OWASP A4:2021 Insecure Design
• STIG-ID:APP3310 Password Masking
• STIG-ID:APP3330 Password Transmission
• STIG-ID:APP3340 Password Storage

Security training

Application security training materials provided by Secure Code Warrior.

• Plaintext Storage Of Passwords Training Video - Test your skills with a training example
• Sensitive Data Exposure Training Video - Test your skills with a training example
• Insufficiently Protected Credentials Training Video - Test your skills with a training example
• Plaintext Storage Of Sensitive Data Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.