Skip to content

Commit 148afe9

Browse files
ESS-ENNESS-ENN
committed
python-mysqlclient-hardcoded-secret-python
1 parent ee71d6d commit 148afe9

File tree

3 files changed

+533
-0
lines changed

3 files changed

+533
-0
lines changed

‎rules/python/security/python-mysqlclient-hardcoded-secret-python.yml

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
id: python-mysqlclient-hardcoded-secret-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).
6+
note: >-
7+
[CWE-798]: Use of Hard-coded Credentials
8+
[A07:2021]: Identification and Authentication Failures
9+
[REFERENCES]
10+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
11+
12+
ast-grep-essentials: true
13+
14+
utils:
15+
define_string:
16+
kind: string
17+
all:
18+
- has:
19+
kind: string_start
20+
nthChild: 1
21+
- has:
22+
kind: string_content
23+
nthChild: 2
24+
- has:
25+
kind: string_end
26+
nthChild: 3
27+
28+
define_password:
29+
any:
30+
- matches: define_string
31+
- kind: identifier
32+
pattern: $PWD_IDENTIFIER
33+
inside:
34+
stopBy: end
35+
follows:
36+
stopBy: end
37+
kind: expression_statement
38+
has:
39+
stopBy: end
40+
kind: assignment
41+
nthChild: 1
42+
all:
43+
- has:
44+
nthChild: 1
45+
kind: identifier
46+
field: left
47+
pattern: $PWD_IDENTIFIER
48+
- has:
49+
nthChild: 2
50+
matches: define_string
51+
52+
keyword_argument_passwd:
53+
kind: keyword_argument
54+
all:
55+
- has:
56+
nthChild: 1
57+
kind: identifier
58+
field: name
59+
regex: ^(passwd)$
60+
- has:
61+
nthChild: 2
62+
matches: define_password
63+
64+
argument_list_util:
65+
kind: argument_list
66+
any:
67+
- has:
68+
matches: keyword_argument_passwd
69+
- all:
70+
- has:
71+
nthChild:
72+
position: 3
73+
ofRule:
74+
not:
75+
kind: comment
76+
matches: define_password
77+
- not:
78+
has:
79+
matches: keyword_argument_passwd
80+
rule:
81+
any:
82+
# MySQLdb.$CONNECT
83+
- kind: call
84+
any:
85+
- kind: call
86+
has:
87+
nthChild: 1
88+
kind: attribute
89+
all:
90+
- has:
91+
nthChild: 1
92+
kind: identifier
93+
field: object
94+
regex: ^MySQLdb$
95+
- has:
96+
nthChild: 2
97+
kind: identifier
98+
field: attribute
99+
pattern: $CONNECT
100+
precedes:
101+
matches: argument_list_util
102+
103+
# MySQLdb._mysql.$CONNECT
104+
- kind: call
105+
any:
106+
- kind: call
107+
has:
108+
nthChild: 1
109+
kind: attribute
110+
all:
111+
- has:
112+
nthChild: 1
113+
regex: ^MySQLdb._mysql$
114+
- has:
115+
nthChild: 2
116+
kind: identifier
117+
field: attribute
118+
pattern: $CONNECT
119+
precedes:
120+
matches: argument_list_util
121+
- kind: call
122+
any:
123+
- kind: call
124+
has:
125+
nthChild: 1
126+
kind: attribute
127+
all:
128+
- has:
129+
nthChild: 1
130+
kind: identifier
131+
field: object
132+
regex: ^_mysql$
133+
- has:
134+
nthChild: 2
135+
kind: identifier
136+
field: attribute
137+
pattern: $CONNECT
138+
precedes:
139+
matches: argument_list_util
140+
inside:
141+
stopBy: end
142+
follows:
143+
stopBy: end
144+
kind: import_from_statement
145+
has:
146+
nthChild: 1
147+
kind: dotted_name
148+
field: module_name
149+
regex: ^MySQLdb$
150+
precedes:
151+
stopBy: end
152+
kind: dotted_name
153+
regex: ^(_mysql)$
154+
155+
- kind: call
156+
any:
157+
- kind: call
158+
has:
159+
nthChild: 1
160+
kind: attribute
161+
all:
162+
- has:
163+
nthChild: 1
164+
kind: identifier
165+
field: object
166+
pattern: $MYSQL_ALIAS
167+
- has:
168+
nthChild: 2
169+
kind: identifier
170+
field: attribute
171+
pattern: $CONNECT
172+
precedes:
173+
matches: argument_list_util
174+
inside:
175+
stopBy: end
176+
follows:
177+
stopBy: end
178+
kind: import_from_statement
179+
has:
180+
nthChild: 1
181+
kind: dotted_name
182+
field: module_name
183+
regex: ^MySQLdb$
184+
precedes:
185+
stopBy: end
186+
kind: aliased_import
187+
all:
188+
- has:
189+
nthChild: 1
190+
kind: dotted_name
191+
field: name
192+
regex: ^_mysql$
193+
- has:
194+
nthChild: 2
195+
kind: identifier
196+
field: alias
197+
pattern: $MYSQL_ALIAS
198+
constraints:
199+
CONNECT:
200+
regex: ^(Connect|connect|Connection|connection)$

0 commit comments

Comments
 (0)