CWE Rule 259

The issue occurs when your code uses a hardcoded password for a service, for example passwd = "guest";.

Hardcoded credentials can be discovered in source code, binaries, or version control and lead to unauthorized access. Authentication failures where the password is hardcoded is difficult to diagnose and mitigate

Do not embed passwords in code. Retrieve secrets at runtime from a secure source, or a configuration file with restricted permissions, or a dedicated secrets manager.

In this example, a hard-coded password is used for a service. Polyspace^® reports a violation.

#include <stddef.h> 
typedef struct _MYSQL MYSQL;
MYSQL *mysql_real_connect(MYSQL *mysql, const char *host, const char *user,
                          const char *passwd, const char *db, unsigned int port,
                          const char *unix_socket, unsigned long client_flag);

extern MYSQL *sql;

void *connect_to_database(const char *db) {
    return mysql_real_connect(sql, "localhost", "guest", "guest", db, 0, 0, 0); // Noncompliant
}

Avoid hard coded password. In this code, the password is retrieved by calling a function. Polyspace does not report a violation.

#include <stdlib.h>
extern const char* getPass();
typedef struct _MYSQL MYSQL;
MYSQL *mysql_real_connect(MYSQL *mysql, const char *host, const char *user,
                          const char *passwd, const char *db, unsigned int port,
                          const char *unix_socket, unsigned long client_flag);

extern MYSQL *sql;

void *connect_to_database(const char *db) {
    return mysql_real_connect(sql, "localhost", "guest", getPass(), db, 0, 0, 0);
}

The issue occurs when an authentication check compares input directly to a hard-coded literal password.

Using a literal in authentication allows anyone who discovers the string to bypass or perform the authentication. Hard-coded comparison logic makes changing or rotating the credential difficult and error-prone.

Do not compare credentials to literals in code. Verify credentials against a secure, external source. For example, use a runtime-provided secret and compare hashed values. Prefer authentication services or libraries that handle secure hashing and salting rather than raw string comparisons against literals.

In this example, the function compares the supplied password directly to a hard-coded literal.

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int VerifyAdmin(char *password) {
    if (strcmp(password, "Mew!")) { //Noncompliant
        printf("Incorrect Password!\n");
        return(0);
    }
    printf("Entering Diagnostic Mode...\n");
    return(1);
}

Compare the supplied credential against a value obtained at runtime. This code retrieves the expected password from the environment via getenv and compares it, avoiding a hard-coded literal.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int VerifyAdmin(const char *password) {
    const char *expected = getenv("ADMIN_PASS");
    if (!expected) {
        fprintf(stderr, "No admin password configured in ADMIN_PASS\n");
        return 0;
    }
    if (strcmp(password, expected) != 0) {
        printf("Incorrect Password!\n");
        return 0;
    }
    printf("Entering Diagnostic Mode...\n");
    return 1;
}

int main(void) {
    VerifyAdmin("attempt");
    return 0;
}