=== on 16 Aug 2018, 11:06:29 Nicolas Harraudeau wrote:
In order to avoid False Positives this rule will limit its detection when the only parameter is the "URL", i.e. ``++DriverManager.getConnection("jdbc:...")++``

The rule then focuses on empty passwords. Example:

----
 DriverManager.getConnection"jdbc:mysql://localhost/test?user=fred&password="); // empty password, detected
 DriverManager.getConnection"jdbc:mysql://localhost/test?user=fred"); // no password, not detected
----
The reason is that there are many different formats to provide a password in a JDBC connection string and it would create many False Positive to match only some of them.

include::../comments-and-links.adoc[]
