NShiftKey

• Revoke and change this password, as it is compromised.

  • Description : https://rules.sonarsource.com/java/RSPEC-6437/
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawavePrincipalLoginModuleTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawavePrincipalLoginModuleTest.java

      Lines 130 to 132 in 012eeed

      	try {
      	return (PrivateKey) keystore.getKey(s, "secret".toCharArray());
      	} catch (KeyStoreException | NoSuchAlgorithmException | UnrecoverableKeyException e) {

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawavePrincipalLoginModuleTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawavePrincipalLoginModuleTest.java

      Lines 92 to 94 in 012eeed

      	serverKeystore = KeyStore.getInstance("PKCS12");
      	serverKeystore.load(getClass().getResourceAsStream("/testServer.pkcs12"), "secret".toCharArray());
      	testUserCert = (X509Certificate) keystore.getCertificate("testuser");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawavePrincipalLoginModuleTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawavePrincipalLoginModuleTest.java

      Lines 88 to 90 in 012eeed

      	truststore = KeyStore.getInstance("PKCS12");
      	truststore.load(getClass().getResourceAsStream("/ca.pkcs12"), "secret".toCharArray());
      	keystore = KeyStore.getInstance("PKCS12");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawavePrincipalLoginModuleTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawavePrincipalLoginModuleTest.java

      Lines 90 to 92 in 012eeed

      	keystore = KeyStore.getInstance("PKCS12");
      	keystore.load(getClass().getResourceAsStream("/testUser.pkcs12"), "secret".toCharArray());
      	serverKeystore = KeyStore.getInstance("PKCS12");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveCertRolesLoginModuleTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveCertRolesLoginModuleTest.java

      Lines 43 to 45 in 012eeed

      	KeyStore keystore = KeyStore.getInstance("PKCS12");
      	keystore.load(getClass().getResourceAsStream("/testUser.pkcs12"), "secret".toCharArray());
      	testUserCert = (X509Certificate) keystore.getCertificate("testuser");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveCertRolesLoginModuleTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveCertRolesLoginModuleTest.java

      Lines 41 to 43 in 012eeed

      	KeyStore truststore = KeyStore.getInstance("PKCS12");
      	truststore.load(getClass().getResourceAsStream("/ca.pkcs12"), "secret".toCharArray());
      	KeyStore keystore = KeyStore.getInstance("PKCS12");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveUsersRolesLoginModuleTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveUsersRolesLoginModuleTest.java

      Lines 56 to 58 in 012eeed

      	KeyStore keystore = KeyStore.getInstance("PKCS12");
      	keystore.load(getClass().getResourceAsStream("/testUser.pkcs12"), "secret".toCharArray());
      	testUserCert = (X509Certificate) keystore.getCertificate("testuser");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveUsersRolesLoginModuleTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveUsersRolesLoginModuleTest.java

      Lines 54 to 56 in 012eeed

      	KeyStore truststore = KeyStore.getInstance("PKCS12");
      	truststore.load(getClass().getResourceAsStream("/ca.pkcs12"), "secret".toCharArray());
      	KeyStore keystore = KeyStore.getInstance("PKCS12");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/auth/DatawaveAuthenticationMechanismTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/auth/DatawaveAuthenticationMechanismTest.java

      Lines 103 to 105 in 012eeed

      	serverKeystore = KeyStore.getInstance("PKCS12");
      	serverKeystore.load(getClass().getResourceAsStream("/testServer.pkcs12"), "secret".toCharArray());
      	testUserCert = (X509Certificate) keystore.getCertificate("testuser");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/auth/DatawaveAuthenticationMechanismTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/auth/DatawaveAuthenticationMechanismTest.java

      Lines 101 to 103 in 012eeed

      	keystore = KeyStore.getInstance("PKCS12");
      	keystore.load(getClass().getResourceAsStream("/testUser.pkcs12"), "secret".toCharArray());
      	serverKeystore = KeyStore.getInstance("PKCS12");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/auth/DatawaveAuthenticationMechanismTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/auth/DatawaveAuthenticationMechanismTest.java

      Lines 99 to 101 in 012eeed

      	truststore = KeyStore.getInstance("PKCS12");
      	truststore.load(getClass().getResourceAsStream("/ca.pkcs12"), "secret".toCharArray());
      	keystore = KeyStore.getInstance("PKCS12");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveCertVerifierTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveCertVerifierTest.java

      Lines 36 to 38 in 012eeed

      	keystore = KeyStore.getInstance("PKCS12");
      	keystore.load(getClass().getResourceAsStream("/testUser.pkcs12"), "secret".toCharArray());
      	testUserCert = (X509Certificate) keystore.getCertificate("testuser");

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveCertVerifierTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/security/src/test/java/datawave/security/login/DatawaveCertVerifierTest.java

      Lines 34 to 36 in 012eeed

      	truststore = KeyStore.getInstance("PKCS12");
      	truststore.load(getClass().getResourceAsStream("/ca.pkcs12"), "secret".toCharArray());
      	keystore = KeyStore.getInstance("PKCS12");

      
        

• Disable access to external entities in XML parsing.

  • Description : https://rules.sonarsource.com/java/RSPEC-2755/
    • Target Code : NationalSecurityAgency-datawave/microservices/configcheck/src/main/java/datawave/microservice/configcheck/XmlPropertyAnalyzer.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/microservices/configcheck/src/main/java/datawave/microservice/configcheck/XmlPropertyAnalyzer.java

      Lines 88 to 90 in 012eeed

      	// find all of the placeholders and values in the original xml, and figure out what their key is
      	DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
      	Document doc = builder.parse(new ByteArrayInputStream(xmlContent.getBytes(StandardCharsets.UTF_8)));

      
        
    • Target Code : NationalSecurityAgency-datawave/web-services/query/src/test/java/datawave/webservice/query/runner/QueryExecutorBeanTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/web-services/query/src/test/java/datawave/webservice/query/runner/QueryExecutorBeanTest.java

      Lines 553 to 555 in 012eeed

      	assertEquals(HttpServletResponse.SC_OK, response.getStatus());
      	DocumentBuilder db = (DocumentBuilderFactory.newInstance()).newDocumentBuilder();
      	Document doc = db.parse(new InputSource(new StringReader(response.getContentAsString())));

      
        
    • Target Code : NationalSecurityAgency-datawave/warehouse/age-off-utils/src/test/java/datawave/age/off/util/RuleConfigDocumentTest.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/warehouse/age-off-utils/src/test/java/datawave/age/off/util/RuleConfigDocumentTest.java

      Lines 156 to 158 in 012eeed

      	private static Transformer initializeXmlTransformer() throws TransformerConfigurationException {
      	Transformer trans = TransformerFactory.newInstance().newTransformer();
      	trans.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");

      
        
    • Target Code : NationalSecurityAgency-datawave/warehouse/age-off-utils/src/main/java/datawave/age/off/util/AgeOffRuleFormatter.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/warehouse/age-off-utils/src/main/java/datawave/age/off/util/AgeOffRuleFormatter.java

      Lines 80 to 82 in 012eeed

      	private Transformer initializeXmlTransformer() throws TransformerConfigurationException {
      	Transformer trans = TransformerFactory.newInstance().newTransformer();
      	trans.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");

      
        

• Thread Safety Violation

  • Description : Data trace can occur if the same member field is accessed at the same time
    • Target Code : NationalSecurityAgency-datawave/core/query/src/main/java/datawave/core/query/logic/composite/CompositeQueryLogic.java [view change history] [ignore this]
      

      NationalSecurityAgency-datawave/core/query/src/main/java/datawave/core/query/logic/composite/CompositeQueryLogic.java

      Lines 129 to 131 in 012eeed

      	if (this.getMaxResults() <= 0)
      	this.setMaxResults(Long.MAX_VALUE);
      	// allow us to get 1 more than maxResults so that the RunningQuery can detect the MAX_RESULTS condition.