Checkmarx: Application contains Hardcoded connection details. This can expose database password

user_8386282 0
Viewed 790

From Checkmarx report:

Application contains Hardcoded connection details. This can expose database password.

I'm using jasypt-spring-boot for password encryption. But in Checkmarx, it marks it as medium vulnerability.

Dependency used:

<dependency>
    <groupId>com.github.ulisesbocchio</groupId>
    <artifactId>jasypt-spring-boot</artifactId>
    <version>2.0.0</version>
</dependency>

In PropertFile:

projectname.password=ENC(encrypted password)

@Value("${projectname.password}")
private String dBpassword;

and using the above dBpassword to connect to the database.

checkmarx password-encryption spring-boot jasypt
1 Answers

Checkmarx is going to have a certain amount of false positives. It isn't possible for it to know every single possibility. So in this case, it doesn't realize that the @Value annotation is actually reading it from a config file. In that case you need to follow your organizations process for handling a false positive and marking the finiding as such in Checkmarx.

user_77327550
Related