/* goodG2B() - use goodsource and badsink */ private void GoodG2B() { string password = null; /* FIX: Use a hardcoded password as the password (it was not sent over the network) */ /* INCIDENTAL FLAW: CWE-259 Hard Coded Password */ password = "******"; goodG2BPublicStatic = true; CWE319_Cleartext_Tx_Sensitive_Info__listen_tcp_SqlConnection_22b.GoodG2BSink(password); }
/* goodB2G1() - use badsource and goodsink by setting the static variable to false instead of true */ private void GoodB2G1() { string password = null; password = ""; /* init password */ /* Read data using a listening tcp connection */ { TcpListener listener = null; try { /* read input from socket */ listener = new TcpListener(IPAddress.Parse("10.10.1.10"), 39543); listener.Start(); using (TcpClient tcpConn = listener.AcceptTcpClient()) { using (StreamReader sr = new StreamReader(Console.OpenStandardInput())) { /* POTENTIAL FLAW: Read password using a listening tcp connection */ password = sr.ReadLine(); } } } catch (IOException exceptIO) { IO.Logger.Log(NLog.LogLevel.Warn, "Error with stream reading", exceptIO); } finally { try { if (listener != null) { listener.Stop(); } } catch (IOException exceptIO) { IO.Logger.Log(NLog.LogLevel.Warn, "Error closing TcpListener", exceptIO); } } } goodB2G1PublicStatic = false; CWE319_Cleartext_Tx_Sensitive_Info__listen_tcp_SqlConnection_22b.GoodB2G1Sink(password); }