Skip to main content

Find hardcoded authentication credentials

org.openrewrite.java.security.search.FindHardcodedAuthenticationCredentials

Finds hardcoded passwords flowing into Spring Security user builders: InMemoryUserDetailsManagerConfigurer (inMemoryAuthentication().withUser(...).password(...)) and the User.UserBuilder.password(...) API. Uses taint analysis so credentials assigned to a variable, field, or constant before being passed to .password(...) are also detected.

Tags​

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Used by​

This recipe is used as part of the following composite recipes:

Example​

Before​
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

class SecurityConfig {
    void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("admin")
            .password("{noop}s3cret")
            .roles("ADMIN");
    }
}
After​
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

class SecurityConfig {
    void configure(AuthenticationManagerBuilder auth) throws Exception {
        /*~~(Hardcoded password supplied to Spring Security user builder (CWE-798))~~>*/auth.inMemoryAuthentication()
            .withUser("admin")
            .password("{noop}s3cret")
            .roles("ADMIN");
    }
}

Usage​

This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI.

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe FindHardcodedAuthenticationCredentials

If the recipe is not available locally, then you can install it using:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.29.2

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Taint flow​

org.openrewrite.analysis.java.taint.table.TaintFlowTable

Records taint flows from sources to sinks with their taint types.

Column NameDescription
Source fileThe source file that the method call occurred in.
Source lineThe line number where the taint source is located.
SourceThe source code where taint originates.
Sink lineThe line number where the taint sink is located.
SinkThe sink code where taint flows to.
Taint typeThe taint type that matched at the sink.