=== on 3 Dec 2020, 11:17:07 Geoffray Adde wrote:
\[~hendrik.buchwald], I did the implementation of the rule in its current state. While doing so, we discussed 3 improvements with [~loic.joly] that could be added to the C/{cpp} version.

* Macros: they are very often used as global variable, especially in C.

----
#define PASSWD secret
----

* For function calls, we could apply the rule to names of parameters (which are a sort of variable). This could catch hard-coded credentials in calls.

----
int connect( const std::string& Url, const std::string& Passwd);
...
connect("124.234.56.7", "secret"); // "secret" is used for parameter Passwd, so we should raise an issue there
----

* Still for the case of hard-coded credentials in function calls. Some libraries/frameworks do something like set(PASSWD, "secret)". So maybe flagging, such function calls with enum named with "passwd" and literals could work.

----
curl_easy_setopt(easyhandle, CURLOPT_USERPWD, "myname:thesecret");
----

What do you think Hendrik?

=== on 3 Dec 2020, 13:53:57 Hendrik Buchwald wrote:
\[~geoffray.adde] all 3 things make sense to me. For the enums it might be hard to detect when they are actually used for assigning literal values though. I fear that just checking for a string literal and an enum with a password-name in a function call might result in too many false-positives. But I don't see a way how to check this before it is implemented. WDYT?

=== on 18 Dec 2020, 08:52:03 Geoffray Adde wrote:
I created https://jira.sonarsource.com/browse/CPP-2852

include::../comments-and-links.adoc[]
