JS: add a js/empty-password-in-configuration-file query #7632
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
erik-krogh
added
WIP
erik-krogh
removed
WIP
esbena
reviewed
Jan 21, 2022
javascript/ql/src/Security/CWE-862/EmptyPasswordInConfigurationFile.qhelp
Outdated
Show resolved
Hide resolved
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
esbena
previously approved these changes
Jan 21, 2022
esbena
added
the
ready-for-doc-review
felicitymay
reviewed
Jan 24, 2022
javascript/ql/src/Security/CWE-862/EmptyPasswordInConfigurationFile.ql
Outdated
Show resolved
Hide resolved
|
|
||
| </overview> | ||
| <recommendation> | ||
| <p>Choose a proper password and encrypt it if it has to stored in a configuration file.</p> |
There was a problem hiding this comment.
Would it be worth including the alternative possibility of storing the password in a secure store and referring to it in the configuration file?
Also - "proper" seems like a strange choice of word. Would "strong" be better here?
kaeluka
reviewed
Jan 24, 2022
|
|
||
| </overview> | ||
| <recommendation> | ||
| <p>Choose a proper password and encrypt it if it has to stored in a configuration file.</p> |
There was a problem hiding this comment.
Suggested change
| <p>Choose a proper password and encrypt it if it has to stored in a configuration file.</p> | |
| <p>Choose a proper password and encrypt it if it has to be stored in a configuration file.</p> |
Co-authored-by: Felicity Chapman <felicitymay@github.com>
esbena
approved these changes
Jan 24, 2022
felicitymay
approved these changes
Jan 24, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Evaluation looks clean.
Inspired by this C# query.
The implementation mostly reuses the logic from our existing
PasswordInConfigurationFile.qlquery.