Description

Detects hardcoded database connection strings containing passwords in JSON configuration files. This represents a security risk since credentials stored in code or configuration files could be exposed to unauthorized users through source code access or configuration file leaks.

Detection Strategy

• Scans JSON configuration files for 'connectionString' key-value pairs

• Checks if the connection string value contains a 'password=' parameter (case-insensitive)

• Validates that the connection string length is less than 1000 characters to avoid false positives

• Reports a vulnerability when a connection string contains an explicit password parameter

Vulnerable code example

{
  "database": {
    "main": {
      "connection": "Server=mydb.example.com;User=admin;Password=secretPass123!", // Vulnerable: Hardcoded sensitive credentials
      "type": "mysql"
    }
  }
}

✅ Secure code example

{
  "database": {
    "main": {
      "connection": { "from_env": "DB_CONNECTION_STRING" }, // Safe: Connection string loaded from environment variable
      "type": "mysql"
    }
  }
}