T09 · Insecure Skill Coding Practices
Error
- Location
README.md:87- Finding
Generated Authentication Example Stores and Compares Plaintext Passwords
- Content
View full analysis
{ boolean existsByEmail(String email); Optional findByEmailAndPassword(String email, String password); } ``` ```java UserEntity entity = new UserEntity(); entity.setName(request.getName()); entity.setEmail(request.getEmail()); entity.setPassword(request.getPassword()); // Actual projects should encrypt this entity.setCreatedAt(LocalDateTime.now()); UserEntity saved = userRepository.save(entity); return toDTO(saved); ``` ```java public UserDTO login(String email, String password) { UserEntity user = userRepository.findByEmailAndPassword(email, password) .orElseThrow(() -> new UserNotFoundException("Invalid email or password")); return toDTO(user); } ``` ### Technical Analysis The reference implementation assigns the submitted password directly to a persistent entity without hashing it. Authentication is then performed through `findByEmailAndPassword`, which requires the database to compare the submitted plaintext password with a stored plaintext value. The comment stating that real projects should encrypt the password does not mitigate the vulnerability. Passwords should not be reversibly encrypted; they must be processed with a password-specific, salted, computationally expensive one-way hashing algorithm. Because this project is an AI coding skill, the vulnerable example can influence generated Spring Boot applications. A user who follows or deploys the generated pattern may unintentionally create a production database containing recoverable passwords. ### Attack Path 1. A user invokes the skill to generate a registration and login implementation. 2. The generated ...[truncated 1290 chars]- Remediation
View remediation
findByEmail(String email); ``` 5. Verify the submitted password using a constant-time password-encoder operation: ```java UserEntity user = userRepository.findByEmail(email) .orElseThrow(() -> new UserNotFoundException("Invalid email or password")); if (!passwordEncoder.matches(rawPassword, user.getPasswordHash())) { throw new UserNotFoundException("Invalid email or password"); } ``` 6. Never include password or password-hash fields in DTOs, API responses, exceptions, application logs, query logs, or audit events. 7. Add an explicit rule to `SKILL.md` requiring secure password hashing whenever authentication code is generated. 8. Add evaluation cases that reject direct password persistence and repository methods that query by raw password. 9. If this pattern has already been deployed, force password resets, invalidate active sessions, rotate affected credentials, and inspect backups and logs for plaintext password exposure. ]]>