Skip to content

BSL012 — Storing confidential information in code

← All rules

Summary

Storing confidential information in code

Identifiers

Field Value
Rule code BSL012
Compatible alias UsingHardcodeSecretInformation
Severity ERROR
Enabled by default Yes
Implemented Yes
Tags security, credentials

Behavior

  • The public identifier BSL012 and alias UsingHardcodeSecretInformation are stable.
  • The rule reports the cases documented on this page.
  • Suppressions and project configuration are applied before publication.
  • The rule requires neither an external analyzer nor network access.

Configuration and suppression

BSL### is the primary stable identifier. The compatible alias is accepted in select, ignore, and compatible block suppression comments.

[tool.onec-hbk-bsl]
select = ["BSL012"]
ignore = ["UsingHardcodeSecretInformation"]

All three suppression families support both a current line and a range. When an opening comment follows code, it affects only that line. Use any one form:

  • noqa:
Value = "example";  // noqa: BSL012
  • bsl-disable:
Value = "example";  // bsl-disable: BSL012
  • compatible BSLLS form:
Value = "example";  // BSLLS:UsingHardcodeSecretInformation-off

When the same opening comment is on a line by itself, it starts a range. Close it with the matching marker from the same family:

// noqa: BSL012
// code without this diagnostic
// noqa-enable: BSL012

// bsl-disable: BSL012
// code without this diagnostic
// bsl-enable: BSL012

// BSLLS:UsingHardcodeSecretInformation-off
// code without this diagnostic
// BSLLS:UsingHardcodeSecretInformation-on

To disable the rule until the end of the file, omit the closing noqa-enable, bsl-enable, or BSLLS:…-on marker.

Opening and closing markers must belong to the same family.

Description

It is prohibited to store any confidential information in the code. The confidential information is:

  • Passwords
  • Personal access tokens/keys

If the project uses SSL sub-system, then passwords should be stored in safe storage.

Addition

Strings with all symbols * are excluded from the check:

Password = "**********";

Examples

Incorrect:

Password = "12345";

Correct:

Passwords = CommonModule.ReadDataFromSafeStorage("StoringIdentifier", "Password");
Password = Passwords.Password;

Sources