Search code examples
xmlsecuritypassword-protection

In XML, is value="[PASSWORD]" a hardcoded password?

I have searched but cannot find an answer to what should be a pretty simple question: Is the following a hardcoded password?

<system-properties>
  <property name="javax.net.ssl.trustStorePassword" value="[PASSWORD]"
</system-properties>

The code also uses keystore-password="[PASSWORD]" truststore-password="[PASSWORD]"

I am reviewing code for vulnerabilities, so I cannot rewrite the code.

Thank you!

Solution

  • XML itself doesn't care whether a password is hardcoded or not, but clearly if you're storing passwords unencrypted in an XML file, it's a security risk, as it would be for any file format.