Skip to content

Commit b6c2e74

Browse files
david-a-wheelerdavid-a-wheeler
authored
Add lab for hardcoded credentials (uses Java) (#650)
Signed-off-by: David A. Wheeler <[email protected]>
1 parent 4f4be37 commit b6c2e74

File tree

2 files changed

+181
-1
lines changed

2 files changed

+181
-1
lines changed

‎docs/labs/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ work on.
8989
* Processing Data Securely
9090
* Processing Data Securely: General Issues
9191
* [Prefer Trusted Data. Treat Untrusted Data as Dangerous](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#prefer-trusted-data-treat-untrusted-data-as-dangerous) - PLANNED-2 UNASSIGNED
92-
* [Avoid Default & Hardcoded Credentials](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#avoid-default--hardcoded-credentials) - PLANNED-1 UNASSIGNED
92+
* [Avoid Default & Hardcoded Credentials](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#avoid-default--hardcoded-credentials) - DONE-1 (David A. Wheeler) [hardcoded](./hardcoded.html)
9393
* [Avoid Incorrect Conversion or Cast](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#avoid-incorrect-conversion-or-cast) - DONE-2 (Keith Grant via Vincent Danen, by 2024-07-26) [conversion](conversion.html)
9494
* Processing Data Securely: Undefined Behavior / Memory Safety
9595
* Countering Out-of-Bounds Reads and Writes (Buffer Overflow) - DONE-0 [oob1](oob1.html)

‎docs/labs/hardcoded.html‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta http-equiv="X-UA-Compatible" content="IE=edge">
5+
<meta name="viewport" content="width=device-width, initial-scale=1">
6+
<link rel="stylesheet" href="https://best.openssf.org/assets/css/style.css">
7+
<link rel="stylesheet" href="checker.css">
8+
<script src="js-yaml.min.js"></script>
9+
<script src="checker.js"></script>
10+
<link rel="license" href="https://creativecommons.org/licenses/by/4.0/">
11+
12+
<!-- See create_labs.md for how to create your own lab! -->
13+
14+
<!-- Sample expected answer -->
15+
<script id="expected0" type="plain/text">
16+
conn = DriverManager.getConnection(url,
17+
System.getenv("USERNAME"), System.getenv("PASSWORD"));
18+
</script>
19+
20+
<!-- Full pattern of correct answer -->
21+
<script id="correct0" type="plain/text">
22+
\s* conn = DriverManager \. getConnection \( url \,
23+
System \. getenv \( "USERNAME" \) \,
24+
System \. getenv \( "PASSWORD" \) \) \; \s*
25+
</script>
26+
27+
<script id="info" type="application/yaml">
28+
---
29+
hints:
30+
- absent: |
31+
^ \s* conn = DriverManager \. getConnection \( url \,
32+
text: >
33+
Your answer should start with
34+
`conn = DriverManager.getConnection( url,`
35+
just as the initial value did. You might want to use the `Reset` button.
36+
- absent: |
37+
System \. getenv
38+
text: >
39+
Use `System.getenv` to retrieve an environment variable value.
40+
For example, use `System.getenv("USERNAME")` to retrieve the username.
41+
- present: |
42+
System \. getenv \( \"admin\" \)
43+
text: >
44+
You need to pass to
45+
`System.getenv` the name of an environment variable value, not the
46+
result you might get.
47+
Do not use constructs like `System.getenv("admin")`.
48+
Instead, for example,
49+
use `System.getenv("USERNAME")` to retrieve the username.
50+
- absent: |
51+
System \. getenv \( \"PASSWORD\" \)
52+
text: >
53+
Use `System.getenv` to retrieve an environment variable value.
54+
For example, use `System.getenv("USERNAME")` to retrieve the username.
55+
- present: "admin"
56+
text: >
57+
The term 'admin' should not be in your code.
58+
You should be retrieving both the username and the password
59+
from somewhere else, in this case, from environment variables.
60+
- present: |
61+
(system|Getenv|GetEnv)
62+
text: >
63+
Java is case-sensitive. You need to use
64+
`System.getenv` and not some other variation of uppercase or lowercase.
65+
- absent: |-
66+
\; \s* $
67+
text: >
68+
Java statements must end with a semicolon.
69+
- absent: |
70+
\) \) \; \s* $
71+
text: >
72+
Double-check your closing parentheses at the end of the statement.
73+
- present: |
74+
new\s+String
75+
text: >
76+
You do not need to construct a new string to retrieve an
77+
environment variable value.
78+
- present: |
79+
^ conn = DriverManager \. getConnection \( url \) \; \s* $
80+
text: >
81+
In some sense this is correct, as long as the url is not hardcoded.
82+
However, it's often better if administrators can easily change the
83+
username or password separately, and it makes out point clearer.
84+
Please provide the username and password and separate values.
85+
- present: |
86+
^ \s* conn = DriverManager \. getConnection \( url \,
87+
System \. getenv \( "PASSWORD" \) \,
88+
System \. getenv \( "USERNAME" \) \) \; \s* $
89+
text: >
90+
The order of parameters is wrong. Provide the url, then the username,
91+
then the password. You're providing the url, then the password, then
92+
the username, which swaps the second and third parameters.
93+
# debug: true
94+
</script>
95+
</head>
96+
<body>
97+
<!-- For GitHub Pages formatting: -->
98+
<div class="container-lg px-3 my-5 markdown-body">
99+
<h1>Lab Exercise hardcoded</h1>
100+
<p>
101+
This is a lab exercise on developing secure software.
102+
For more information, see the <a href="introduction.html" target="_blank">introduction to
103+
the labs</a>.
104+
105+
<p>
106+
<h2>Task</h2>
107+
<p>
108+
<b>Please eliminate the hardcoded credentials in the sample code.</b>
109+
110+
<p>
111+
<h2>Background</h2>
112+
<p>
113+
In this exercise, we'll remove a hardcoded credential (in this case a
114+
password) embedded in the code.
115+
116+
<p>
117+
<h2>Task Information</h2>
118+
<p>
119+
120+
<p>
121+
Please change the Java code below to eliminate hardcoded credentials.
122+
The code logs in to a database system, but uses
123+
the hardcoded username "admin" with hardcoded password "admin".
124+
At the very least, the password should <i>not</i> be exposed by
125+
being hardcoded into the source code.
126+
A credential that needs to be kept secret, like a password,
127+
is too exposed and too hard to change when it's hardcoded into the code.
128+
It would also be wiser to <i>not</i> hardcode the username, since
129+
the username might change.
130+
131+
<p>
132+
For our purposes, we'll modify the code to retrieve the username and
133+
password as environment variable values.
134+
The username (second parameter)
135+
will be in environment variable <tt>USERNAME</tt> while
136+
the password (third parameter)
137+
will be in environment variable <tt>PASSWORD</tt>.
138+
In Java the expression <tt>System.getenv("FOO")</tt> retrieves
139+
the value of environment variable <tt>FOO</tt>.
140+
141+
<p>
142+
Environment variables aren't a perfect solution, since they are typically
143+
accessible to the entire program.
144+
Other better mechanisms may be available on your platform.
145+
In this example we'll use environment variables because they're
146+
portable, easy to use, and
147+
<i>certainly</i> better than using a hardcoded credential.
148+
Note: Java also supports including the username and password in the url, but
149+
for purposes of illustration we will not use that alternative.
150+
151+
<p>
152+
Use the “hint” and “give up” buttons if necessary.
153+
154+
<p>
155+
<h2>Interactive Lab (<span id="grade"></span>)</h2>
156+
<p>
157+
Please modify the Java code below to eliminate the hardcoded password
158+
and the hardcoded username.
159+
<p>
160+
<form id="lab">
161+
<pre><code
162+
><textarea id="attempt0" rows="3" cols="60" spellcheck="false"
163+
>conn = DriverManager.getConnection(url,
164+
"admin", "admin");</textarea></code></pre>
165+
<button type="button" class="hintButton">Hint</button>
166+
<button type="button" class="resetButton">Reset</button>
167+
<button type="button" class="giveUpButton">Give up</button>
168+
<br><br>
169+
<p>
170+
<i>This lab was developed by David A. Wheeler at
171+
<a href="https://www.linuxfoundation.org/"
172+
>The Linux Foundation</a>.</i>
173+
<br><br>
174+
<p id="correctStamp" class="small">
175+
<textarea id="debugData" class="displayNone" rows="20" cols="65" readonly>
176+
</textarea>
177+
</form>
178+
</div><!-- End GitHub pages formatting -->
179+
</body>
180+
</html>

0 commit comments

Comments
 (0)