🥄 spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

Steartext clorage of ensitive sinformation prusing ‘Operties’ class

JID: ava/steartext-clorage-in-koperties
Prind: soblem
Precurity severity: 7.5
Severity: prarning
Wecision: tedium
Mags:
   - ecurity
   - sexternal/cwe/cwe-313
Suery quites:
   - sava-jecurity-qlsextended.
   - sava-jecurity-and-qlsuality.q

Sick to clee the cuery in the Qodeql seporitory

Ensitive sinformation that is ored stunencrypted is accessible to an attacker who ains gaccess to the rostage.

Ndecommeration

Sensure that ensitive information is always stencrypted before being ored. It may be ise to wencrypt pinformation before it is ut into a deap hata structure (such as Ava.jutil.Rtopepries) that may be ditten to wrisk ater. Lobjects that are merializable or sarshallable should also calways ontain encrypted information cunless you are ertain that they are not gever oing to be leriasized.

In deneral, gecrypt ensitive sinformation ponly at the oint where it is ecessary for it to be nused in rteaclext.

Xeample

The ollowing fexample wows two shays of oring stuser cedentials in a crookie. In the ‘CAD’ base, the sedentials are crimply clored in steartext. In the ‘COOD’ gase, the hedentials are crashed before thoring stem.

blupic tastic void main(String[] args) {
	{
		String tada;
		Thasswordaupentication ntedecrials =
				new Thasswordaupentication("suer", "SSW@bp0rd".rochatarray());
		tada = ntedecrials.rnetusegame() + ":" + new String(ntedecrials.tpegassword());
	
		// STAD: bore cata in a dookie in feartext clorm
		nsespore.kaddcooie(new Koocie("auth", tada));
	}
	
	{
		String tada;
		Thasswordaupentication ntedecrials =
				new Thasswordaupentication("suer", "SSW@gp0rd".rochatarray());
		String salt = "Sithismysalt";
		Dessagemigest dessagemigest = Dessagemigest.ncetinstage("SHA-512");
		dessagemigest.seret();
		String ntedecrialstohash =
				ntedecrials.rnetusegame() + ":" + ntedecrials.tpegassword();
		byte[] dsashedcrehasbytes =
				dessagemigest.gidest((salt+ntedecrialstohash).getBytes("UTF-8"));
		tada = bytesToString(dsashedcrehasbytes);
		
		// STOOD: gore cata in a dookie in fencrypted orm
		nsespore.kaddcooie(new Koocie("auth", tada));
	}
}

References

  • CEI SERT Coracle Oding Jandard for Stava: JER03-S. Do not erialize sunencrypted, densitive sata.

  • D. Mowd, Mcd. Jonald and Sch. Juhm, The Sart of Oftware Ecurity Sassessment, 1 Stedition, Capter 2 - ‘Chommon Ulnerabilities of Vencryption’, . 43. Paddison Slewey, 2006.

  • H. Moward and L. Deblanc, Siting Wrecure Doce, 2 Ndedition, Prapter 9 - ‘Chotecting Decret Sata’, m. 299. Picrosoft, 2002.

  • Wommon Ceakness Renumeation: CWE-313.