logo

Database

Java Hardcoded Redis Password

Description

Detects hardcoded Redis passwords when using the Jedis client in Java applications. Embedding credentials directly in source code is a security risk as it can lead to unauthorized access if the code is exposed. These credentials should instead be stored securely in configuration files or environment variables.

Weakness:

359 - Sensitive information in source code - Credentials

Category: Information Collection

Detection Strategy

    • Code imports Redis/Jedis related libraries

    • Redis client objects are created with password parameters

    • Method calls contain hardcoded string literals used as Redis passwords

    • Connection credentials are passed directly in code rather than loaded from configuration

Vulnerable code example

import redis.clients.jedis.JedisClientConfig;
import redis.clients.jedis.DefaultJedisClientConfig;

public class RedisExample {
    public void configureRedis() {
        // Hardcoded password directly in builder configuration
        JedisClientConfig config = DefaultJedisClientConfig.builder()
            .password("secret123")  // Insecure: Hardcoded credential in source code...

✅ Secure code example

import redis.clients.jedis.JedisClientConfig;
import redis.clients.jedis.DefaultJedisClientConfig;

public class RedisExample {
    public void configureRedis(String password) {  // Accept password as parameter
        JedisClientConfig config = DefaultJedisClientConfig.builder()
            .password(password)  // Safe: Password provided via configuration/environment
            .build();...