Repository navigation
Home
Welcome to the com.castsoftware.uc.typescript.rule.hardcoded wiki!
Target audience: This document is to be used in the use of Extension made available by the Community of CAST Users by IT professionals experienced in operating CAST AIP platform for Application analysis.
Warning: The Extension described in this document is delivered as-is. This Extension is made available by CAST User Community and governed by Open Source License. Please consider all necessary steps to validate and to test the Extension in your environment before using it in production.
The extension is published under GNU LGPL v3 open source license
This extension adds violations on top of those found by the standard rule 1020820- Avoid hard-coded passwords (TypeScript).
Password detection based on variable names now covers more naming patterns, so more variables are recognized as holding credentials.
String literals that contain base64/base64url-encoded content are now decoded and inspected.
| CAST AIP release | Supported |
|---|---|
| Imaging Core 8.4.0 to 8.4.12+ |  |
| AIP Core 8.3.6 to 8.3.60+ | |
| AIP 8.3.x (x < 6) |  |
This extension requires and depends on TypeScript 1.21.0-beta1.
Select the following custom extension:
com.castsoftware.uc.typescript.rule.hardcoded.1.x.y, seen in Console Extension pane.
Include this extension.
Note: a dependency has been set with com.castsoftware.uc.typescript.
This is to ensure com.castsoftware.uc.typescript.rule.hardcoded is never installed alone and to ensure the minimal release required for the collaboration between the 2 extensions.
Once included manually (or with Force install), this extension is integrated to the normal process of a TypeScript analysis.
Normal TypeScript analysis.
The standard QR 1020820- Avoid hard-coded passwords (TypeScript) will be enriched potentially by additional violations found in decoded base64 strings.
Results will be seen in CAST Dashboards as usual.
none identified
none so far
Initial version. Successfully tested at R&D.