Skip to content

Commit 1735d18

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add YAML security rules and tests for hard-coded secret detection (#185)
* removed missing-secure-java * httponly-false-csharp * use-of-md5-digest-utils-java * removing use-of-md5-digest-utils and httponly-false-csharp * python-requests-hardcoded-secret-python * python-requests-oauth-hardcoded-secret-python --------- Co-authored-by: Sakshis <sakshil@abc.com>
1 parent 08f0e5f commit 1735d18

6 files changed

+709
-0
lines changed

‎rules/python/security/python-requests-hardcoded-secret-python.yml

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
id: python-requests-hardcoded-secret-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
15+
ast-grep-essentials: true
16+
17+
utils:
18+
requests.auth.HTTPBasicAuth($USER,"",...):
19+
kind: call
20+
all:
21+
- has:
22+
stopBy: neighbor
23+
kind: attribute
24+
regex: ^requests.auth.HTTPBasicAuth$|^requests.auth.HTTPDigestAuth$|^requests.auth.HTTPProxyAuth$
25+
- has:
26+
stopBy: neighbor
27+
kind: argument_list
28+
not:
29+
has:
30+
nthChild: 3
31+
has:
32+
stopBy: neighbor
33+
kind: string
34+
nthChild: 2
35+
has:
36+
stopBy: end
37+
kind: string_content
38+
39+
HTTPBasicAuth($USER,"",...):
40+
kind: call
41+
all:
42+
- has:
43+
stopBy: neighbor
44+
kind: identifier
45+
regex: ^(HTTPBasicAuth)$
46+
- has:
47+
stopBy: neighbor
48+
kind: argument_list
49+
not:
50+
has:
51+
nthChild: 3
52+
has:
53+
stopBy: neighbor
54+
kind: string
55+
nthChild: 2
56+
has:
57+
stopBy: end
58+
kind: string_content
59+
- any:
60+
- follows:
61+
stopBy: end
62+
kind: import_from_statement
63+
any:
64+
- pattern: from requests.auth import HTTPBasicAuth
65+
- inside:
66+
stopBy: end
67+
follows:
68+
stopBy: end
69+
kind: import_from_statement
70+
any:
71+
- pattern: from requests.auth import HTTPBasicAuth
72+
73+
HTTPProxyAuth($USER,"",...):
74+
kind: call
75+
all:
76+
- has:
77+
stopBy: neighbor
78+
kind: identifier
79+
regex: ^(HTTPProxyAuth)$
80+
- has:
81+
stopBy: neighbor
82+
kind: argument_list
83+
not:
84+
has:
85+
nthChild: 3
86+
has:
87+
stopBy: neighbor
88+
kind: string
89+
nthChild: 2
90+
has:
91+
stopBy: end
92+
kind: string_content
93+
- any:
94+
- follows:
95+
stopBy: end
96+
kind: import_from_statement
97+
any:
98+
- pattern: from requests.auth import HTTPProxyAuth
99+
- inside:
100+
stopBy: end
101+
follows:
102+
stopBy: end
103+
kind: import_from_statement
104+
any:
105+
- pattern: from requests.auth import HTTPProxyAuth
106+
107+
HTTPDigestAuth($USER,"",...):
108+
kind: call
109+
all:
110+
- has:
111+
stopBy: neighbor
112+
kind: identifier
113+
regex: ^(HTTPDigestAuth)$
114+
- has:
115+
stopBy: neighbor
116+
kind: argument_list
117+
not:
118+
has:
119+
nthChild: 3
120+
has:
121+
stopBy: neighbor
122+
kind: string
123+
nthChild: 2
124+
has:
125+
stopBy: end
126+
kind: string_content
127+
- any:
128+
- follows:
129+
stopBy: end
130+
kind: import_from_statement
131+
any:
132+
- pattern: from requests.auth import HTTPProxyAuth
133+
- inside:
134+
stopBy: end
135+
follows:
136+
stopBy: end
137+
kind: import_from_statement
138+
any:
139+
- pattern: from requests.auth import HTTPDigestAuth
140+
141+
rule:
142+
kind: call
143+
any:
144+
- matches: HTTPProxyAuth($USER,"",...)
145+
- matches: HTTPDigestAuth($USER,"",...)
146+
- matches: HTTPBasicAuth($USER,"",...)
147+
- matches: requests.auth.HTTPBasicAuth($USER,"",...)
148+
not:
149+
all:
150+
- has:
151+
stopBy: end
152+
kind: ERROR
153+
- inside:
154+
stopBy: end
155+
kind: ERROR

0 commit comments

Comments
 (0)