Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 60e0f09

Browse files
bananabrsmowton
bananabr
authored and
smowton
committed
Additional hardcoded credentials candidates 3rd-party api calls
1 parent 1d56330 commit 60e0f09

1 file changed

Lines changed: 44 additions & 1 deletion

File tree

‎java/ql/src/Security/CWE/CWE-798/SensitiveApi.qll‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -438,6 +438,49 @@ private predicate otherApiCallableCredentialParam(string s) {
438438
"com.azure.identity.UsernamePasswordCredentialBuilder;username(String);0",
439439
"com.azure.identity.UsernamePasswordCredentialBuilder;password(String);0",
440440
"com.azure.identity.ClientSecretCredentialBuilder;clientSecret(String);0",
441-
"org.apache.shiro.mgt.AbstractRememberMeManager;setCipherKey(byte[]);0"
441+
"org.apache.shiro.mgt.AbstractRememberMeManager;setCipherKey(byte[]);0",
442+
"com.jcraft.jsch.JSch;getSession(String, String, int);0",
443+
"com.jcraft.jsch.JSch;getSession(String, String);0",
444+
"ch.ethz.ssh2.Connection;authenticateWithPassword(String, String);0",
445+
"org.apache.sshd.client.SshClient;connect(String, String, int);0",
446+
"org.apache.sshd.client.SshClient;connect(String, SocketAddress);0",
447+
"net.schmizz.sshj.SSHClient;authPassword(String, char[]);0",
448+
"net.schmizz.sshj.SSHClient;authPassword(String, String);0",
449+
"com.sshtools.j2ssh.authentication.SshAuthenticationClient;setUsername(String);0",
450+
"com.sshtools.j2ssh.authentication.PasswordAuthenticationClient;setUsername(String);0",
451+
"com.trilead.ssh2.Connection;authenticateWithPassword(String, String);0",
452+
"com.trilead.ssh2.Connection;authenticateWithDSA(String, String, String);0",
453+
"com.trilead.ssh2.Connection;authenticateWithNone(String);0",
454+
"com.trilead.ssh2.Connection;getRemainingAuthMethods(String);0",
455+
"com.trilead.ssh2.Connection;isAuthMethodAvailable(String, String);0",
456+
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, char[], String);0",
457+
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, File, String);0",
458+
"com.jcraft.jsch.Session;setPassword(byte[]);0",
459+
"com.jcraft.jsch.Session;setPassword(String);0",
460+
"ch.ethz.ssh2.Connection;authenticateWithPassword(String, String);1",
461+
"org.apache.sshd.client.session.AbstractClientSession;addPasswordIdentity(String);0",
462+
"net.schmizz.sshj.SSHClient;authPassword(String, char[]);1",
463+
"net.schmizz.sshj.SSHClient;authPassword(String, String);1",
464+
"com.sshtools.j2ssh.authentication.PasswordAuthenticationClient;setPassword(String);0",
465+
"com.trilead.ssh2.Connection;authenticateWithPassword(String, String);1",
466+
"com.trilead.ssh2.Connection;authenticateWithDSA(String, String, String);2",
467+
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, char[], String);2",
468+
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, File, String);2",
469+
"com.trilead.ssh2.Connection;authenticateWithDSA(String, String, String);1",
470+
"com.trilead.ssh2.Connection;authenticateWithPublicKey(String, char[], String);1",
471+
"org.apache.commons.net.ftp.FTPClient;login(String, String);0",
472+
"org.apache.commons.net.ftp.FTPClient;login(String, String, String);0",
473+
"org.apache.commons.net.ftp.FTPClient;login(String, String);1",
474+
"org.apache.commons.net.ftp.FTPClient;login(String, String, String);1",
475+
"com.mongodb.MongoCredential;createCredential(String, String, char[]);0",
476+
"com.mongodb.MongoCredential;createMongoCRCredential(String, String, char[]);0",
477+
"com.mongodb.MongoCredential;createPlainCredential(String, String, char[]);0",
478+
"com.mongodb.MongoCredential;createScramSha1Credential(String, String, char[]);0",
479+
"com.mongodb.MongoCredential;createGSSAPICredential(String);0",
480+
"com.mongodb.MongoCredential;createMongoX509Credential(String);0",
481+
"com.mongodb.MongoCredential;createCredential(String, String, char[]);2",
482+
"com.mongodb.MongoCredential;createMongoCRCredential(String, String, char[]);2",
483+
"com.mongodb.MongoCredential;createPlainCredential(String, String, char[]);2",
484+
"com.mongodb.MongoCredential;createScramSha1Credential(String, String, char[]);2"
442485
]
443486
}

0 commit comments

Comments
 (0)