B107.md

Pattern: Use of hard-coded password argument defaults

Issue: -

Description

The use of hard-coded passwords increases the possibility of password guessing tremendously. This rule looks for all function definitions that specify a default string literal for some argument. It checks that the argument does not look like a password.

Variables are considered to look like a password if they have match any one of:

• password
• pass
• passwd
• pwd
• secret
• token
• secrete

Note: this can be noisy and may generate false positives.

Example of insecure code:

def someFunction(user, password="Admin"):
    print("Hi " + user)

Further Reading

• OWASP - Use of hard-coded password
• Bandit - B107: hardcoded_password_default