Skip to content

Commit 4f277d7

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add Java rules for detecting hardcoded secrets in System.setProperty and OkHttp (#175)
* system-setproperty-hardcoded-secret-java * hardcoded-secret-in-credentials-java --------- Co-authored-by: Sakshis <sakshil@abc.com>
1 parent 65ef683 commit 4f277d7

6 files changed

+803
-0
lines changed

‎rules/java/security/hardcoded-secret-in-credentials-java.yml

Lines changed: 292 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,292 @@
1+
id: hardcoded-secret-in-credentials-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
15+
ast-grep-essentials: true
16+
utils:
17+
Credentials.basic($USERNAME, "..."):
18+
kind: method_invocation
19+
all:
20+
- has:
21+
kind: identifier
22+
nthChild: 1
23+
regex: ^Credentials$
24+
- has:
25+
kind: identifier
26+
nthChild: 2
27+
regex: ^basic$
28+
- has:
29+
kind: argument_list
30+
all:
31+
- not:
32+
has:
33+
nthChild:
34+
position: 3
35+
ofRule:
36+
not:
37+
kind: line_comment
38+
- has:
39+
kind: string_literal
40+
nthChild:
41+
position: 2
42+
ofRule:
43+
not:
44+
kind: line_comment
45+
has:
46+
kind: string_fragment
47+
- inside:
48+
stopBy: end
49+
follows:
50+
stopBy: end
51+
kind: import_declaration
52+
any:
53+
- pattern: import okhttp3.Credentials.*;
54+
- pattern: import okhttp3.*;
55+
56+
Credentials.basic($USERNAME, "...")_with_Instance:
57+
kind: method_invocation
58+
all:
59+
- has:
60+
kind: identifier
61+
nthChild: 1
62+
regex: ^Credentials$
63+
- has:
64+
kind: identifier
65+
nthChild: 2
66+
regex: ^basic$
67+
- has:
68+
kind: argument_list
69+
all:
70+
- not:
71+
has:
72+
nthChild:
73+
position: 3
74+
ofRule:
75+
not:
76+
kind: line_comment
77+
- has:
78+
kind: identifier
79+
pattern: $PASSWORD
80+
nthChild:
81+
position: 2
82+
ofRule:
83+
not:
84+
kind: line_comment
85+
- inside:
86+
stopBy: end
87+
follows:
88+
stopBy: end
89+
kind: import_declaration
90+
any:
91+
- pattern: import okhttp3.Credentials.*;
92+
- pattern: import okhttp3.*;
93+
- inside:
94+
stopBy: end
95+
follows:
96+
stopBy: end
97+
any:
98+
- kind: field_declaration
99+
has:
100+
kind: variable_declarator
101+
all:
102+
- has:
103+
kind: identifier
104+
pattern: $PASSWORD
105+
- has:
106+
kind: string_literal
107+
has:
108+
kind: string_fragment
109+
110+
basic($USERNAME, "..."):
111+
kind: method_invocation
112+
all:
113+
- has:
114+
kind: identifier
115+
nthChild: 1
116+
regex: ^basic$
117+
- has:
118+
kind: argument_list
119+
all:
120+
- not:
121+
has:
122+
nthChild:
123+
position: 3
124+
ofRule:
125+
not:
126+
kind: line_comment
127+
- has:
128+
kind: string_literal
129+
nthChild:
130+
position: 2
131+
ofRule:
132+
not:
133+
kind: line_comment
134+
has:
135+
kind: string_fragment
136+
- inside:
137+
stopBy: end
138+
follows:
139+
stopBy: end
140+
kind: import_declaration
141+
any:
142+
- pattern: import okhttp3.Credentials.*;
143+
144+
basic($USERNAME, "...")_with_Instance:
145+
kind: method_invocation
146+
all:
147+
- has:
148+
kind: identifier
149+
nthChild: 1
150+
regex: ^basic$
151+
- has:
152+
kind: argument_list
153+
all:
154+
- not:
155+
has:
156+
nthChild:
157+
position: 3
158+
ofRule:
159+
not:
160+
kind: line_comment
161+
- has:
162+
kind: identifier
163+
pattern: $PASSWORD
164+
nthChild:
165+
position: 2
166+
ofRule:
167+
not:
168+
kind: line_comment
169+
- inside:
170+
stopBy: end
171+
follows:
172+
stopBy: end
173+
kind: import_declaration
174+
any:
175+
- pattern: import okhttp3.Credentials.*;
176+
177+
okhttp3.Credentials.basic($USERNAME, "..."):
178+
kind: method_invocation
179+
all:
180+
- has:
181+
kind: field_access
182+
all:
183+
- has:
184+
kind: identifier
185+
nthChild: 1
186+
regex: ^okhttp3$
187+
- has:
188+
kind: identifier
189+
nthChild: 2
190+
regex: ^Credentials$
191+
- has:
192+
kind: identifier
193+
nthChild: 2
194+
regex: ^basic$
195+
- has:
196+
kind: argument_list
197+
all:
198+
- not:
199+
has:
200+
nthChild:
201+
position: 3
202+
ofRule:
203+
not:
204+
kind: line_comment
205+
- has:
206+
kind: string_literal
207+
nthChild:
208+
position: 2
209+
ofRule:
210+
not:
211+
kind: line_comment
212+
has:
213+
kind: string_fragment
214+
- inside:
215+
stopBy: end
216+
follows:
217+
stopBy: end
218+
kind: import_declaration
219+
any:
220+
- pattern: import okhttp3.Credentials.*;
221+
- pattern: import okhttp3.Credentials;
222+
223+
okhttp3.Credentials.basic($USERNAME, "...")_with_Instance:
224+
kind: method_invocation
225+
all:
226+
- has:
227+
kind: field_access
228+
all:
229+
- has:
230+
kind: identifier
231+
nthChild: 1
232+
regex: ^okhttp3$
233+
- has:
234+
kind: identifier
235+
nthChild: 2
236+
regex: ^Credentials$
237+
- has:
238+
kind: identifier
239+
nthChild: 2
240+
regex: ^basic$
241+
- has:
242+
kind: argument_list
243+
all:
244+
- not:
245+
has:
246+
nthChild:
247+
position: 3
248+
ofRule:
249+
not:
250+
kind: line_comment
251+
- has:
252+
kind: identifier
253+
pattern: $PASSWORD
254+
nthChild:
255+
position: 2
256+
ofRule:
257+
not:
258+
kind: line_comment
259+
- inside:
260+
stopBy: end
261+
follows:
262+
stopBy: end
263+
kind: import_declaration
264+
any:
265+
- pattern: import okhttp3.Credentials.*;
266+
- pattern: import okhttp3.Credentials;
267+
- inside:
268+
stopBy: end
269+
follows:
270+
stopBy: end
271+
any:
272+
- kind: field_declaration
273+
has:
274+
kind: variable_declarator
275+
all:
276+
- has:
277+
kind: identifier
278+
pattern: $PASSWORD
279+
- has:
280+
kind: string_literal
281+
has:
282+
kind: string_fragment
283+
284+
rule:
285+
any:
286+
- matches: Credentials.basic($USERNAME, "...")
287+
- matches: Credentials.basic($USERNAME, "...")_with_Instance
288+
- matches: basic($USERNAME, "...")
289+
- matches: basic($USERNAME, "...")_with_Instance
290+
- matches: okhttp3.Credentials.basic($USERNAME, "...")
291+
- matches: okhttp3.Credentials.basic($USERNAME, "...")_with_Instance
292+

0 commit comments

Comments
 (0)