Can't detect password in application.yaml or application.properties of a Java project

SonarQube Server / Community Build
,
1

I attempted to detect passwords in src/main/resources/application.properties or src/main/resources/application.yaml or application.xml of a Java project using SonarQube maven plugin. I added Qualities Profile for Java and XML. The YAML Qualities Profile has no rules. The results of scanning is SonarQube can detect the hard coded passwords in the Java source code rather than application’s property files like .properties, .yaml, or .xml although I added them in sonar-project.properties. The output of SonarQube showed these files were bounded into the target but hard coded passwords were not detected at all. Did anyone successfully use SonarQube server or Cloud to find out hard coded passwords in Java application property files?

Thanks,

John

2

Hi John,

Welcome to the community!

Given your project structure, I’m guessing you analyzed with SonarScanner for Maven, which doesn’t analyze resources by default. To broaden your analysis to include non-JVM-related files. you’ll need to use the scanAll option.

 
HTH,
Ann