T09 · Insecure Skill Coding Practices
Warning
- Location
data/metadata-mapping.md:94- Finding
Plaintext Password Persistence and Credential Disclosure Through Logging
- Content
View full analysis
``` It creates users with plaintext passwords, modifies a password as plaintext, and logs complete user objects: ```java public static void main(String[] args) { // get service var userService = new UserService(); // use create service to add users for (var user : generateSampleUsers()) { var id = userService.createUser(user); LOGGER.info("Add user" + user + "at" + id + "."); } // use list service to get users var users = userService.listUser(); LOGGER.info(String.valueOf(users)); // use get service to get a user var user = userService.getUser(1); LOGGER.info(String.valueOf(user)); // change password of user 1 user.setPassword("new123"); // use update service to update user 1 userService.updateUser(1, user); // use delete service to delete user 2 userService.deleteUser(2); // close service userService.close(); } public static List generateSampleUsers() { final var user1 = new User("ZhangSan", "zhs123"); final var user2 = new User("LiSi", "ls123"); final var user3 = new User("WangWu", "ww123"); return List.of(user1, user2, user3); } ``` The documented output confirms that passwords are included in application logs: ```text 14:44:18.508 [main] INFO com.iluwatar.metamapping.App - Add userUser(id=1, username=ZhangSan, password=zhs123)at1. 14:44:18.509 [main] INFO com.iluwatar.metamapping.App - Add userUser(id=2, username=LiSi, password=ls123)at2. 14:44:18.512 [main] INFO com.iluwatar.me ...[truncated 2886 chars]- Remediation
View remediation