[PHP] False positive "Remove this hard-coded password"

[li...@nitsnets.com]

Using Laravel commands.

Command definition:

class User extends CommandInterface
{
    /**
     * Usage help
     *
     * @var string
     */
    protected $signature = 'user:add {--email=} {--name=} {--password=}';
   
    /**
     * @var string
     */
    protected $description = 'Add an user to system';

Usage from terminal:

php artisan user:add --email=admin@admin.com --name=Admin --password=admin

Error

class User extends CommandInterface
{
    /**
     * Usage help
     *
     * @var string
     */
    protected $signature = 'cms:user:add {--email=} {--name=} {--password=}';
   
    Remove this hard-coded password.

Regards!

[carlo.bo...@gmail.com]

Hello,

thanks for reporting this. I've created a jira ticket to improve the rule : https://jira.sonarsource.com/browse/SONARPHP-707

In the meanwhile, you could mark these as "false-positive" in SonarQube.

Cheers,

Carlo