Java: CWE-555 Query to detect plaintext credentials in Java properties files

[luchua-bc]

It's a very common issue that credentials are stored in plaintext in application’s properties files. Common credentials include but are not limited to LDAP, mail, database, proxy account, and so on. Credentials management issues occur with such a configuration. Storing plaintext credentials in a properties file allows anyone who can read the file access to the protected resource. Good credentials management guidelines require that credentials never be stored in plaintext.

This query detects plaintext credentials stored in Java properties files by checking common patterns of confidential credentials used in Java applications.

Please consider to merge the PR. Thanks.

[luchua-bc]

@smowton Thanks for reviewing this PR. However, as the relevant issue #327 has already been rejected and closed, do we still want to make changes to this query? Please advise.

[smowton]

It's up to you. I'm happy to merge the simple version of this as basically useful, if too simple for the bounty program.

[luchua-bc]

OK, I will make the changes since it will be merged into main and I still believe it's a useful query.

[smowton]

Also I believe some of the Spring additions are no longer required?

[luchua-bc]

I've removed unused Java programs since the query only checks properties files now.