27 lines
847 B
Plaintext
27 lines
847 B
Plaintext
|
== How to fix it in Java SE
|
||
|
|
|
||
|
|
=== Code examples
|
||
|
|
|
||
|
|
The following code uses an empty password to connect to a Postgres database.
|
||
|
|
|
||
|
|
The vulnerability can be fixed by using a strong password retrieved from Properties. This `database.password` property is set during deployment. Its value should be strong and different for each database.
|
||
|
|
|
||
|
|
==== Noncompliant code example
|
||
|
|
|
||
|
|
[source,java,diff-id=201,diff-type=noncompliant]
|
||
|
|
----
|
||
|
|
Connection conn = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "login", ""); // Noncompliant
|
||
|
|
----
|
||
|
|
|
||
|
|
==== Compliant solution
|
||
|
|
|
||
|
|
[source,java,diff-id=201,diff-type=compliant]
|
||
|
|
----
|
||
|
|
String password = System.getProperty("database.password");
|
||
|
|
Connection conn = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "login", password);
|
||
|
|
----
|
||
|
|
|
||
|
|
=== Pitfalls
|
||
|
|
|
||
|
|
include::../../common/pitfalls/hard-coded.adoc[]
|