/* goodG2B() - use GoodSource and BadSink */ private static void GoodG2B() { string password; /* FIX: Use a hardcoded password as the password (it was not sent over the network) */ /* INCIDENTAL FLAW: CWE-259 Hard Coded Password */ password = "******"; LinkedList <string> passwordLinkedList = new LinkedList <string>(); passwordLinkedList.AddLast(password); passwordLinkedList.AddLast(password); passwordLinkedList.AddLast(password); CWE319_Cleartext_Tx_Sensitive_Info__listen_tcp_SqlConnection_73b.GoodG2BSink(passwordLinkedList); }
public override void Bad() { string password; password = ""; /* init password */ /* Read data using a listening tcp connection */ { TcpListener listener = null; try { /* read input from socket */ listener = new TcpListener(IPAddress.Parse("10.10.1.10"), 39543); listener.Start(); using (TcpClient tcpConn = listener.AcceptTcpClient()) { using (StreamReader sr = new StreamReader(Console.OpenStandardInput())) { /* POTENTIAL FLAW: Read password using a listening tcp connection */ password = sr.ReadLine(); } } } catch (IOException exceptIO) { IO.Logger.Log(NLog.LogLevel.Warn, "Error with stream reading", exceptIO); } finally { try { if (listener != null) { listener.Stop(); } } catch (IOException exceptIO) { IO.Logger.Log(NLog.LogLevel.Warn, "Error closing TcpListener", exceptIO); } } } LinkedList <string> passwordLinkedList = new LinkedList <string>(); passwordLinkedList.AddLast(password); passwordLinkedList.AddLast(password); passwordLinkedList.AddLast(password); CWE319_Cleartext_Tx_Sensitive_Info__listen_tcp_SqlConnection_73b.BadSink(passwordLinkedList); }