CWE Rule 259

R2026b

Use of Hard-coded Password

Since R2026b

expand all in page

Description

Use of Hard-coded Password

Polyspace Implementation

Polyspace checks for these issues:

  • Password for Service Hardcoded

  • Authentication Using Comparison with Hardcoded Password

Examples

expand all

Issue

The issue occurs when your code uses a hardcoded password for a service, for example passwd = "guest";.

Risk

Hardcoded credentials can be discovered in source code, binaries, or version control and lead to unauthorized access. Authentication failures where the password is hardcoded is difficult to diagnose and mitigate

Fix

Do not embed passwords in code. Retrieve secrets at runtime from a secure source, or a configuration file with restricted permissions, or a dedicated secrets manager.

Example

In this example, a hard-coded password is used for a service. Polyspace® reports a violation. 

#include <stddef.h> 
typedef struct _MYSQL MYSQL;
MYSQL *mysql_real_connect(MYSQL *mysql, const char *host, const char *user,
                          const char *passwd, const char *db, unsigned int port,
                          const char *unix_socket, unsigned long client_flag);

extern MYSQL *sql;

void *connect_to_database(const char *db) {
    return mysql_real_connect(sql, "localhost", "guest", "guest", db, 0, 0, 0); // Noncompliant
}
Correction

Avoid hard coded password. In this code, the password is retrieved by calling a function. Polyspace does not report a violation.

#include <stdlib.h>
extern const char* getPass();
typedef struct _MYSQL MYSQL;
MYSQL *mysql_real_connect(MYSQL *mysql, const char *host, const char *user,
                          const char *passwd, const char *db, unsigned int port,
                          const char *unix_socket, unsigned long client_flag);

extern MYSQL *sql;

void *connect_to_database(const char *db) {
    return mysql_real_connect(sql, "localhost", "guest", getPass(), db, 0, 0, 0);
}
Issue

The issue occurs when an authentication check compares input directly to a hard-coded literal password.

Risk

Using a literal in authentication allows anyone who discovers the string to bypass or perform the authentication. Hard-coded comparison logic makes changing or rotating the credential difficult and error-prone.

Fix

Do not compare credentials to literals in code. Verify credentials against a secure, external source. For example, use a runtime-provided secret and compare hashed values. Prefer authentication services or libraries that handle secure hashing and salting rather than raw string comparisons against literals.

Example

In this example, the function compares the supplied password directly to a hard-coded literal. 

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int VerifyAdmin(char *password) {
    if (strcmp(password, "Mew!")) { //Noncompliant
        printf("Incorrect Password!\n");
        return(0);
    }
    printf("Entering Diagnostic Mode...\n");
    return(1);
}
Correction

Compare the supplied credential against a value obtained at runtime. This code retrieves the expected password from the environment via getenv and compares it, avoiding a hard-coded literal. 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int VerifyAdmin(const char *password) {
    const char *expected = getenv("ADMIN_PASS");
    if (!expected) {
        fprintf(stderr, "No admin password configured in ADMIN_PASS\n");
        return 0;
    }
    if (strcmp(password, expected) != 0) {
        printf("Incorrect Password!\n");
        return 0;
    }
    printf("Entering Diagnostic Mode...\n");
    return 1;
}

int main(void) {
    VerifyAdmin("attempt");
    return 0;
}

Check Information

Category: Others
PQL Name: std.cwe_native.R259

Version History

Introduced in R2026b

See Also

Topics