[java] HardcodedCryptoKey false negative with variable assignments

[ghost]

Affects PMD Version: 6.35.0

Rule:HardcodedCryptoKey

Please provide the rule name and a link to the rule documentation:
https://pmd.github.io/pmd-6.35.0/pmd_rules_java_security.html#hardcodedcryptokey

Description:
PMD should have reported a warning to detect the bug at line 9 because when str is assigned by a string constant in the true branch, the program will exist a security flaw.

Code Sample demonstrating the issue:

public void testHardCodedCryptoKey(boolean tag) {       
   String str;
   if(tag) {
      str = "Hardcoded Crypto Key1";
   } else {
      str = "Hardcoded Crypto Key2";
   }
   SecretKeySpec secretKeySpec = new SecretKeySpec(str.getBytes(), "AES");  // should report a warning here
}

Expected outcome:

PMD should report a violation at line 9, but doesn't. This is a false-negative.

Running PMD through: [Maven]

[ghost]

@oowekyala, hi Clément, could you please help me check issue? Thanks!

[adangel]

I think, that's a real false-negative. The rule currently only checks the initializer of the variable. In your code sample, the variable str is not initialized at all, so the rule doesn't see a problem.

We probably would need to enhance the rule to check all assignments to the variable as well...

[ghost]

Hi Andres, thanks for your kind and prompt reply! 👍 Hope you had a nice weekend.