Skip to content

Commit 0d5a1e2

Browse files
author
Sakshis
committed
python-webrepl-hardcoded-secret-python
1 parent b5d26b3 commit 0d5a1e2

File tree

3 files changed

+283
-0
lines changed

3 files changed

+283
-0
lines changed

‎rules/python/security/python-webrepl-hardcoded-secret-python.yml

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
id: python-webrepl-hardcoded-secret-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798]: Use of Hard-coded Credentials
12+
[OWASP A07:2021]: Identification and Authentication Failures
13+
[REFERENCES]
14+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
utils:
16+
match_call:
17+
kind: call
18+
all:
19+
- has:
20+
stopBy: end
21+
kind: attribute
22+
field: function
23+
all:
24+
- has:
25+
stopBy: end
26+
kind: identifier
27+
field: object
28+
regex: "^webrepl$"
29+
- has:
30+
stopBy: end
31+
kind: identifier
32+
field: attribute
33+
regex: "^start$"
34+
- has:
35+
stopBy: end
36+
kind: argument_list
37+
field: arguments
38+
has:
39+
stopBy: end
40+
kind: keyword_argument
41+
all:
42+
- has:
43+
kind: identifier
44+
field: name
45+
regex: "^password$"
46+
- has:
47+
kind: string
48+
field: value
49+
all:
50+
- has:
51+
kind: string_start
52+
- has:
53+
kind: string_content
54+
- has:
55+
kind: string_end
56+
inside:
57+
stopBy: end
58+
kind: expression_statement
59+
match_call_with_identifier:
60+
kind: call
61+
all:
62+
- has:
63+
stopBy: end
64+
kind: attribute
65+
field: function
66+
all:
67+
- has:
68+
stopBy: end
69+
kind: identifier
70+
field: object
71+
regex: "^webrepl$"
72+
- has:
73+
stopBy: end
74+
kind: identifier
75+
field: attribute
76+
regex: "^start$"
77+
- has:
78+
stopBy: end
79+
kind: argument_list
80+
field: arguments
81+
has:
82+
stopBy: end
83+
kind: keyword_argument
84+
all:
85+
- has:
86+
kind: identifier
87+
field: name
88+
regex: "^password$"
89+
- has:
90+
kind: identifier
91+
field: value
92+
pattern: $PASS
93+
inside:
94+
stopBy: end
95+
kind: expression_statement
96+
follows:
97+
stopBy: end
98+
kind: expression_statement
99+
has:
100+
stopBy: end
101+
kind: assignment
102+
all:
103+
- has:
104+
kind: identifier
105+
pattern: $PASS
106+
- has:
107+
kind: string
108+
rule:
109+
any:
110+
- matches: match_call
111+
- matches: match_call_with_identifier

‎tests/__snapshots__/python-webrepl-hardcoded-secret-python-snapshot.yml

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
id: python-webrepl-hardcoded-secret-python
2+
snapshots:
3+
? |
4+
PASSWORD2 = "hardcodedsecret"
5+
webrepl.start(password=PASSWORD2)
6+
: labels:
7+
- source: webrepl.start(password=PASSWORD2)
8+
style: primary
9+
start: 30
10+
end: 63
11+
- source: webrepl
12+
style: secondary
13+
start: 30
14+
end: 37
15+
- source: start
16+
style: secondary
17+
start: 38
18+
end: 43
19+
- source: webrepl.start
20+
style: secondary
21+
start: 30
22+
end: 43
23+
- source: password
24+
style: secondary
25+
start: 44
26+
end: 52
27+
- source: PASSWORD2
28+
style: secondary
29+
start: 53
30+
end: 62
31+
- source: password=PASSWORD2
32+
style: secondary
33+
start: 44
34+
end: 62
35+
- source: (password=PASSWORD2)
36+
style: secondary
37+
start: 43
38+
end: 63
39+
- source: PASSWORD2
40+
style: secondary
41+
start: 0
42+
end: 9
43+
- source: '"hardcodedsecret"'
44+
style: secondary
45+
start: 12
46+
end: 29
47+
- source: PASSWORD2 = "hardcodedsecret"
48+
style: secondary
49+
start: 0
50+
end: 29
51+
- source: PASSWORD2 = "hardcodedsecret"
52+
style: secondary
53+
start: 0
54+
end: 29
55+
- source: webrepl.start(password=PASSWORD2)
56+
style: secondary
57+
start: 30
58+
end: 63
59+
? |
60+
webrepl.start(password="12345")
61+
: labels:
62+
- source: webrepl.start(password="12345")
63+
style: primary
64+
start: 0
65+
end: 31
66+
- source: webrepl
67+
style: secondary
68+
start: 0
69+
end: 7
70+
- source: start
71+
style: secondary
72+
start: 8
73+
end: 13
74+
- source: webrepl.start
75+
style: secondary
76+
start: 0
77+
end: 13
78+
- source: password
79+
style: secondary
80+
start: 14
81+
end: 22
82+
- source: '"'
83+
style: secondary
84+
start: 23
85+
end: 24
86+
- source: '12345'
87+
style: secondary
88+
start: 24
89+
end: 29
90+
- source: '"'
91+
style: secondary
92+
start: 29
93+
end: 30
94+
- source: '"12345"'
95+
style: secondary
96+
start: 23
97+
end: 30
98+
- source: password="12345"
99+
style: secondary
100+
start: 14
101+
end: 30
102+
- source: (password="12345")
103+
style: secondary
104+
start: 13
105+
end: 31
106+
- source: webrepl.start(password="12345")
107+
style: secondary
108+
start: 0
109+
end: 31
110+
? |
111+
webrepl.start(password="mypassword")
112+
: labels:
113+
- source: webrepl.start(password="mypassword")
114+
style: primary
115+
start: 0
116+
end: 36
117+
- source: webrepl
118+
style: secondary
119+
start: 0
120+
end: 7
121+
- source: start
122+
style: secondary
123+
start: 8
124+
end: 13
125+
- source: webrepl.start
126+
style: secondary
127+
start: 0
128+
end: 13
129+
- source: password
130+
style: secondary
131+
start: 14
132+
end: 22
133+
- source: '"'
134+
style: secondary
135+
start: 23
136+
end: 24
137+
- source: mypassword
138+
style: secondary
139+
start: 24
140+
end: 34
141+
- source: '"'
142+
style: secondary
143+
start: 34
144+
end: 35
145+
- source: '"mypassword"'
146+
style: secondary
147+
start: 23
148+
end: 35
149+
- source: password="mypassword"
150+
style: secondary
151+
start: 14
152+
end: 35
153+
- source: (password="mypassword")
154+
style: secondary
155+
start: 13
156+
end: 36
157+
- source: webrepl.start(password="mypassword")
158+
style: secondary
159+
start: 0
160+
end: 36

‎tests/python/python-webrepl-hardcoded-secret-python-test.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: python-webrepl-hardcoded-secret-python
2+
valid:
3+
- |
4+
webrepl.start(password=os.getenv('PASSWORD'))
5+
invalid:
6+
- |
7+
webrepl.start(password="mypassword")
8+
- |
9+
webrepl.start(password="12345")
10+
- |
11+
PASSWORD2 = "hardcodedsecret"
12+
webrepl.start(password=PASSWORD2)

0 commit comments

Comments
 (0)