Example 1
The following code reads a password from a properties file and uses
the password to connect to a database.
(Bad Code)
Example
Language: Java
...
Properties prop = new Properties();
prop.load(new FileInputStream("config.properties"));
String password = prop.getProperty("password");
DriverManager.getConnection(url, usr, password);
...
This code will run successfully, but anyone who has access to
config.properties can read the value of password. If a devious employee
has access to this information, they can use it to break into the
system.
Example 2
The following code reads a password from the registry and uses the
password to create a new network credential.
(Bad Code)
Example
Language: Java
...
String password = regKey.GetValue(passKey).toString();
NetworkCredential netCred = new
NetworkCredential(username,password,domain);
...
This code will run successfully, but anyone who has access to the
registry key used to store the password can read the value of password.
If a devious employee has access to this information, they can use it to
break into the system
Example 3
The following examples show a portion of properties and
configuration files for Java and ASP.NET applications. The files include
username and password information but they are stored in
plaintext.
This Java example shows a properties file with a plaintext username /
password pair.
(Bad Code)
Example
Language: Java
# Java Web App ResourceBundle properties file
...
webapp.ldap.username=secretUsername
webapp.ldap.password=secretPassword
...
The following example shows a portion of a configuration file for an
ASP.Net application. This configuration file includes username and
password information for a connection to a database but the pair is
stored in plaintext.
(Bad Code)
Example
Language: ASP.NET
...
<connectionStrings>
<add name="ud_DEV" connectionString="connectDB=uDB;
uid=db2admin; pwd=password; dbalias=uDB;"
providerName="System.Data.Odbc" />
</connectionStrings>
...
Username and password information should not be included in a configuration file or a properties file in plaintext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information and avoid CWE-260 and CWE-13.
Description
