MuleSoft common coding mistakes #1 – Unsecured data storage

MuleSoft applications may store sensitive information in plain text or with weak encryption, which could result in data breaches. Below example code shows trust and key store

<http:listener-config name="HTTP_Listener" doc:name="HTTP Listener config" >
		<http:listener-connection host="localhost" port="8081" >
			<tls:context >
				<tls:trust-store password="test" type="jks" />
				<tls:key-store type="jks" keyPassword="test" password="test" />
			</tls:context>
      </http:listener-connection>
</http:listener-config>

Integral Zone’s static code analyis plugin, IZ Analyzer, provides two out-of-the-box rules to automatically identify such security issues. As an Anypoint Studio plugin, IZ Analyzer provides this feedback in real-time at the time of development so that the issues can be rectified even before the code is checked into the source code respository.

M00009 - HTTPS - TLS Trust Store Password is NOT externalized
M00010 - HTTPS - TLS Key Store Passwords is NOT externalized