HP Fortify false positive Hard Coded Password - Java

user_1148166 0
Viewed 7985

I am having trouble figuring out a solution to a problen HP Fortify SCA is reporting. The issue it reports is:

Hardcoded passwords may compromise system security in a way that cannot be easily remedied.

The code looks similar to this:

@Configuration
public class MySpringConfig {

    private final String userName;

    private final String password;

    @Autowired
    public MySpringConfig(
            @Value("${my.userName}") final String userName,
            @Value("${my.password}") final String password) {
        this.host = host;
        this.userName = userName;
        this.password = password;
    }
    ...
}

I cannot understand why Fortify would think this is a hard coded password. The password is being passed as a parameter to the constructor, and it is coming from a Spring @Value.

I have considered using @FortifyNotPassword to stop this false positive, but this is actually a password. I'd rather not use that annotation because it could then miss real issues, like logging this field's value.

fortify java
3 Answers

Fortify thinks this is a hard-coded password because the tool is not as smart as a human! It is one of the most frequent false positives I encounter as a code reviewer.

Fortify should not be used in an automated fashion without a human code auditor. Fortify is there to help a code reviewer look at interesting stuff, not to replace the code reviewer. The code reviewer needs to either suppress or filter out this issue manually.

If you want a more automated solution, Fortify is not the right tool because it brings up too many false positives.

user_38238310

Yeah, it is the fact that Fortify is just not that smart. It turns out that the complaint was tied to the fact that "password" appeared in the String @Value("${my.password}"). Simply changing it to @Value("${my.value}") made the error go away.

There was also a relation to the fact that it was stored in a field. In the end, I rearranged the class more like this and the violation went away:

@Configuration
public class MySpringConfig {

    @Bean
    public MyBean myBean(
            @Value("${my.userName}") final String userName,
            @Value("${my.password}") final String password) {
        return new MyBeanThatNeedsUserCredentials(userName, password);
    }

}
user_11481660

Fortify has different analyzers. In this case, it looks like the semantic analyzer was used. It's simply a grep for the word "password". So you can evaluate this case to a false positive. The semantic analyzer tends to be very noisy.

If you use the AuditWorkbench, under the Summary tab (after you click on a finding) you can see the which engine was used to find the issue. It's on the right side of the panel.

user_83730830
Related