Description

This detector identifies hardcoded passwords used in Scala PBEKeySpec (Password-Based Encryption Key Specification) constructors. Hardcoded passwords in cryptographic operations create serious security risks because they are visible in source code, cannot be rotated easily, and compromise the security of encrypted data if the code is exposed.

Detection Strategy

• Scan Scala source code files for imports of javax.crypto.spec.PBEKeySpec, javax.crypto.spec._, or javax.crypto.spec.*

• Locate all constructor calls to PBEKeySpec in the codebase

• Examine the first argument (password parameter) of each PBEKeySpec constructor call

• Check if the password argument is a hardcoded value (string literal, constant, or statically defined variable) rather than dynamically obtained

• Report a vulnerability when a PBEKeySpec constructor uses a hardcoded password as its first argument

Vulnerable code example

import javax.crypto.SecretKeyFactory
import javax.crypto.spec.PBEKeySpec

object PBEUtil {
  val salt: Array[Byte] = Array[Byte](1, 2, 3, 4, 5, 6, 7, 8)
  val iterations = 65536

  def deriveKey1(): Array[Byte] = {...

✅ Secure code example

import javax.crypto.SecretKeyFactory
import javax.crypto.spec.PBEKeySpec

object PBEUtil {
  val salt: Array[Byte] = Array[Byte](1, 2, 3, 4, 5, 6, 7, 8)
  val iterations = 65536

  def deriveKey1(): Array[Byte] = {...