Q
Detector Library
C detectors (34/34)
Logging of sensitive informationInsecure Use Of ChrootDeadlock And Lock InconsistencyUnsafe File ExtensionOS command injectionIncorrect Use Of FreeUse Of Uninitialized VariableInsecure Use strcat fnSQL injectionBitwise Operator On Signed OperandInsecure use gets fnRandom fd exhaustionRedundant Free UsageInsecure Use MemsetDivide By Zero.Return Stack AddressUnchecked Return ValueIncorrect Format SpecifierUnhandled Expression ResultPath traversalImproper Input ValidationOut Of Bounds ReadInteger OverflowInsecure use strtok functionImproper size of a memory bufferincomplete-cleanupNull pointer dereferenceInsecure Temporary File Or DirectoryInsecure Buffer AccessIncorrect Use Ato FnLoose File PermissionsExposure of Sensitive InformationOut-of-bounds WriteString Equality
Exposure of Sensitive Information High
We observed that your code contains either incorrect, unsafe cleartext protocols, which leads to transmission of sensitive information over a network or communication channel in cleartext, making it vulnerable to interception by attackers.
Detector ID
c/exposure-of-sensitive-information@v1.0
Category
Noncompliant example
1
2int exposureofSensitiveInformationNonCompliant()
3{
4 // Noncompliant: insecure protocal is used
5 char* ftp_url = "ftp://anonymous@example.com";
6
7}
Compliant example
1int exposureofSensitiveInformationCompliant()
2{
3 // Compliant: https is used for secured url
4 char* https_url = "https://example.com";
5}