Description

Detects hardcoded passwords in database connection strings for MySQL, MSSQL, and PostgreSQL clients in JavaScript code. This poses a security risk as embedding credentials directly in source code could lead to unauthorized database access if the code is exposed.

Detection Strategy

• Check for database connection calls using MySQL, MSSQL or PostgreSQL clients

• Examine the first argument (configuration object) of the connection call

• Look for password fields that contain hardcoded string values

• Flag cases where the password is a literal string rather than an environment variable or configuration value

Vulnerable code example

const mysql = require('mysql');

// Database connection with hardcoded credentials
const connection = mysql.createConnection({
  host: 'localhost',
  user: 'root',
  password: 'admin123'  // VULNERABLE: Hardcoded credential should not be in source code
});

✅ Secure code example

const mysql = require('mysql');

// Database connection using environment variables
const connection = mysql.createConnection({
  host: process.env.DB_HOST,
  user: process.env.DB_USER,
  password: process.env.DB_PASSWORD  // SECURE: Credentials loaded from environment variables
});