java-hardcoded-credentials-mining

Read-only mining codemod for SonarSource rule java:S6437 — Credentials should not be hard-coded.

It scans Java source and emits metrics only; it never modifies code (return null).
Findings are high-signal review candidates surfaced by AST pattern matching — they are
not proven vulnerabilities. A static mining pass cannot prove an end-to-end taint flow
from an untrusted source to the sink, so confirm data flow before remediating.

What it detects

Credential-setting APIs invoked with a hard-coded, non-empty string literal.

Sinks:

• setPassword / setUser(name) / setSecret / setSecretKey / setAccessKey / setApiKey / setCredentials / setToken / withPassword / withUsername / basicAuthentication / setBasicAuth
• new PasswordAuthentication / UsernamePasswordCredentials / BasicAWSCredentials / UsernamePasswordAuthenticationToken / NTCredentials

Emission rule: Emits when a credential argument is a non-empty string literal (including "...".toCharArray()). Values from env/config method calls are skipped.

Metric: java-hardcoded-credentials-mining

Security standards

• CWE-259 (Use of Hard-coded Password)
• CWE-798 (Use of Hard-coded Credentials)
• OWASP Top 10 2021: A7
• OWASP Top 10: A2

Run locally

bash
Copy
cd codemods/java-security-blocker-mining/java-hardcoded-credentials-mining
npm test

# Scan a target project (read-only; emits metrics, leaves source unchanged)
npx codemod@latest workflow run \
  -w codemods/java-security-blocker-mining/java-hardcoded-credentials-mining/workflow.yaml \
  --target /path/to/java/project

Part of the java-security-blocker-mining suite covering 19 blocker-severity
Java vulnerability rules. Each codemod is read-only and emits a single named metric.