Skip to content

Commit 69cb18d

Browse files
ESS-ENNESS-ENN
committed
scrypt-hardcoded-secret-swift
1 parent d3cef68 commit 69cb18d

File tree

4 files changed

+275
-0
lines changed

4 files changed

+275
-0
lines changed

‎rules/swift/pkcs5-hardcoded-secret-swift.yml renamed to ‎rules/swift/security/pkcs5-hardcoded-secret-swift.yml

File renamed without changes.

‎rules/swift/security/scrypt-hardcoded-secret-swift.yml

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
id: scrypt-hardcoded-secret-swift
2+
language: swift
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[OWASP A07:2021]:Identification and Authentication Failures
12+
[CWE-798]: Use of Hard-coded Credentials
13+
[REFERENCES]
14+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
utils:
16+
match_property_declaration:
17+
kind: property_declaration
18+
all:
19+
- has:
20+
stopBy: end
21+
kind: call_expression
22+
has:
23+
stopBy: end
24+
kind: value_argument
25+
all:
26+
- has:
27+
stopBy: end
28+
kind: simple_identifier
29+
field: name
30+
regex: "^password$"
31+
- has:
32+
stopBy: end
33+
kind: simple_identifier
34+
field: value
35+
pattern: $R
36+
- follows:
37+
stopBy: end
38+
kind: property_declaration
39+
has:
40+
stopBy: end
41+
kind: pattern
42+
has:
43+
kind: simple_identifier
44+
pattern: $R
45+
match_call_expression:
46+
kind: call_expression
47+
has:
48+
stopBy: end
49+
kind: navigation_expression
50+
has:
51+
stopBy: end
52+
kind: value_argument
53+
all:
54+
- has:
55+
stopBy: end
56+
kind: simple_identifier
57+
regex: "^password$"
58+
- has:
59+
stopBy: end
60+
kind: line_string_literal
61+
has:
62+
stopBy: end
63+
kind: line_str_text
64+
match_call_expression_follows_property_declaration:
65+
kind: call_expression
66+
has:
67+
stopBy: end
68+
kind: navigation_expression
69+
all:
70+
- has:
71+
stopBy: end
72+
kind: call_expression
73+
has:
74+
kind: simple_identifier
75+
regex: "^Scrypt$"
76+
- has:
77+
stopBy: end
78+
kind: call_suffix
79+
has:
80+
kind: value_arguments
81+
all:
82+
- has:
83+
kind: value_argument
84+
all:
85+
- has:
86+
kind: simple_identifier
87+
field: name
88+
regex: "^password$"
89+
- has:
90+
kind: simple_identifier
91+
field: value
92+
pattern: $M
93+
follows:
94+
stopBy: end
95+
kind: property_declaration
96+
all:
97+
- has:
98+
stopBy: end
99+
kind: value_binding_pattern
100+
regex: "^let$"
101+
- has:
102+
stopBy: end
103+
kind: pattern
104+
field: name
105+
has:
106+
stopBy: end
107+
kind: simple_identifier
108+
field: bound_identifier
109+
pattern: $M
110+
- has:
111+
stopBy: end
112+
kind: type_annotation
113+
- has:
114+
stopBy: end
115+
kind: call_expression
116+
match_follows_line_string_literal:
117+
kind: call_expression
118+
has:
119+
stopBy: end
120+
kind: navigation_expression
121+
all:
122+
- has:
123+
stopBy: end
124+
kind: call_expression
125+
has:
126+
stopBy: end
127+
kind: simple_identifier
128+
regex: "^Scrypt$"
129+
- has:
130+
stopBy: end
131+
kind: call_suffix
132+
all:
133+
- has:
134+
stopBy: end
135+
kind: value_arguments
136+
- has:
137+
stopBy: end
138+
kind: value_argument
139+
has:
140+
stopBy: end
141+
kind: simple_identifier
142+
field: name
143+
regex: "^password$"
144+
- has:
145+
stopBy: end
146+
kind: call_expression
147+
has:
148+
stopBy: end
149+
kind: simple_identifier
150+
regex: "^Array$"
151+
- has:
152+
stopBy: end
153+
kind: call_suffix
154+
- has:
155+
stopBy: end
156+
kind: value_arguments
157+
- has:
158+
stopBy: end
159+
kind: value_argument
160+
- has:
161+
stopBy: end
162+
kind: navigation_expression
163+
has:
164+
stopBy: end
165+
kind: simple_identifier
166+
pattern: $L
167+
- has:
168+
stopBy: end
169+
kind: navigation_suffix
170+
has:
171+
stopBy: end
172+
kind: simple_identifier
173+
regex: "^utf8$"
174+
follows:
175+
kind: property_declaration
176+
all:
177+
- has:
178+
kind: value_binding_pattern
179+
regex: "^let$"
180+
- has:
181+
kind: pattern
182+
field: name
183+
has:
184+
kind: simple_identifier
185+
field: bound_identifier
186+
pattern: $L
187+
- has:
188+
kind: line_string_literal
189+
field: value
190+
has:
191+
kind: line_str_text
192+
field: text
193+
194+
rule:
195+
any:
196+
- matches: match_property_declaration
197+
- matches: match_call_expression
198+
- matches: match_call_expression_follows_property_declaration
199+
- matches: match_follows_line_string_literal

‎tests/__snapshots__/scrypt-hardcoded-secret-swift-snapshot.yml

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
id: scrypt-hardcoded-secret-swift
2+
snapshots:
3+
? |
4+
let ishan: Array<UInt8> = Array("s33krit".utf8)
5+
let key = try Scrypt(password: ishan, salt: salt, dkLen: 64, N: 16384, r: 8, p: 1).calculate()
6+
: labels:
7+
- source: 'let key = try Scrypt(password: ishan, salt: salt, dkLen: 64, N: 16384, r: 8, p: 1).calculate()'
8+
style: primary
9+
start: 48
10+
end: 142
11+
- source: password
12+
style: secondary
13+
start: 69
14+
end: 77
15+
- source: ishan
16+
style: secondary
17+
start: 79
18+
end: 84
19+
- source: 'password: ishan'
20+
style: secondary
21+
start: 69
22+
end: 84
23+
- source: 'try Scrypt(password: ishan, salt: salt, dkLen: 64, N: 16384, r: 8, p: 1).calculate()'
24+
style: secondary
25+
start: 58
26+
end: 142
27+
- source: ishan
28+
style: secondary
29+
start: 4
30+
end: 9
31+
- source: ishan
32+
style: secondary
33+
start: 4
34+
end: 9
35+
- source: 'let ishan: Array<UInt8> = Array("s33krit".utf8)'
36+
style: secondary
37+
start: 0
38+
end: 47
39+
? |
40+
try Scrypt(password: "123", salt: salt, dkLen: 64, N: 16384, r: 8, p: 1).calculate()
41+
: labels:
42+
- source: 'try Scrypt(password: "123", salt: salt, dkLen: 64, N: 16384, r: 8, p: 1).calculate()'
43+
style: primary
44+
start: 0
45+
end: 84
46+
- source: password
47+
style: secondary
48+
start: 11
49+
end: 19
50+
- source: '123'
51+
style: secondary
52+
start: 22
53+
end: 25
54+
- source: '"123"'
55+
style: secondary
56+
start: 21
57+
end: 26
58+
- source: 'password: "123"'
59+
style: secondary
60+
start: 11
61+
end: 26
62+
- source: 'try Scrypt(password: "123", salt: salt, dkLen: 64, N: 16384, r: 8, p: 1).calculate'
63+
style: secondary
64+
start: 0
65+
end: 82

‎tests/swift/scrypt-hardcoded-secret-swift-test.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
id: scrypt-hardcoded-secret-swift
2+
valid:
3+
- |
4+
try Scrypt(password: config, salt: salt, dkLen: 64, N: 16384, r: 8, p: 1).calculate()
5+
invalid:
6+
- |
7+
let ishan: Array<UInt8> = Array("s33krit".utf8)
8+
let key = try Scrypt(password: ishan, salt: salt, dkLen: 64, N: 16384, r: 8, p: 1).calculate()
9+
- |
10+
try Scrypt(password: "123", salt: salt, dkLen: 64, N: 16384, r: 8, p: 1).calculate()
11+

0 commit comments

Comments
 (0)