Skip to content

Commit 72e144d

Browse files
ESS-ENNESS-ENN
authored
Rules - One php and one java rule (#20)
1 parent 2e7cc23 commit 72e144d

6 files changed

+310
-0
lines changed

‎rules/java/security/drivermanager-hardcoded-secret-java.yml

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
id: drivermanager-hardcoded-secret-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
utils:
15+
MATCH_PATTERN_DriverManager.getConnection:
16+
kind: method_invocation
17+
all:
18+
- has:
19+
stopBy: neighbor
20+
kind: identifier
21+
regex: "^DriverManager$"
22+
- has:
23+
stopBy: neighbor
24+
kind: identifier
25+
regex: "^getConnection$"
26+
- has:
27+
stopBy: end
28+
kind: argument_list
29+
nthChild: 3
30+
has:
31+
stopBy: end
32+
kind: string_literal
33+
nthChild: 3
34+
35+
MATCH_PATTERN_DriverManager.getConnection_With_Instance:
36+
kind: method_invocation
37+
all:
38+
- has:
39+
stopBy: neighbor
40+
kind: identifier
41+
regex: "^DriverManager$"
42+
- has:
43+
stopBy: neighbor
44+
kind: identifier
45+
regex: "^getConnection$"
46+
- has:
47+
stopBy: end
48+
kind: argument_list
49+
has:
50+
stopBy: end
51+
kind: identifier
52+
nthChild: 3
53+
pattern: $Q
54+
- inside:
55+
stopBy: end
56+
kind: local_variable_declaration
57+
follows:
58+
stopBy: end
59+
kind: local_variable_declaration
60+
has:
61+
stopBy: end
62+
kind: variable_declarator
63+
all:
64+
- has:
65+
stopBy: end
66+
kind: identifier
67+
pattern: $Q
68+
- has:
69+
stopBy: end
70+
kind: string_literal
71+
72+
MATCH_PATTERN_DriverManagerDataSource:
73+
kind: expression_statement
74+
has:
75+
stopBy: neighbor
76+
kind: object_creation_expression
77+
all:
78+
- has:
79+
stopBy: neighbor
80+
kind: type_identifier
81+
regex: "^DriverManagerDataSource$"
82+
- has:
83+
stopBy: end
84+
kind: argument_list
85+
has:
86+
stopBy: end
87+
kind: string_literal
88+
nthChild: 3
89+
90+
MATCH_PATTERN_DriverManagerDataSource_With_Instance:
91+
kind: expression_statement
92+
all:
93+
- has:
94+
stopBy: neighbor
95+
kind: method_invocation
96+
all:
97+
- has:
98+
stopBy: neighbor
99+
kind: identifier
100+
pattern: $R
101+
- has:
102+
stopBy: neighbor
103+
kind: identifier
104+
regex: "^setPassword$"
105+
- has:
106+
stopBy: neighbor
107+
kind: argument_list
108+
has:
109+
stopBy: neighbor
110+
kind: string_literal
111+
- follows:
112+
stopBy: end
113+
kind: local_variable_declaration
114+
all:
115+
- has:
116+
stopBy: neighbor
117+
kind: type_identifier
118+
regex: "^DriverManagerDataSource$"
119+
- has:
120+
stopBy: neighbor
121+
kind: variable_declarator
122+
has:
123+
stopBy: neighbor
124+
kind: identifier
125+
pattern: $R
126+
rule:
127+
any:
128+
- kind: method_invocation
129+
any:
130+
- matches: MATCH_PATTERN_DriverManager.getConnection
131+
- matches: MATCH_PATTERN_DriverManager.getConnection_With_Instance
132+
- kind: expression_statement
133+
any:
134+
- matches: MATCH_PATTERN_DriverManagerDataSource
135+
- matches: MATCH_PATTERN_DriverManagerDataSource_With_Instance

‎rules/php/security/search-active-debug-php.yml

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
id: search-active-debug-php
2+
language: php
3+
severity: warning
4+
message: >-
5+
Debug logging is explicitly enabled. This can potentially disclose
6+
sensitive information and should never be active on production systems.
7+
note: >-
8+
[CWE-489] Active Debug Code.
9+
[REFERENCES]
10+
- https://www.php.net/manual/en/function.setcookie.php
11+
utils:
12+
Match_pattern_one:
13+
kind: expression_statement
14+
has:
15+
stopBy: end
16+
kind: function_call_expression
17+
pattern: $C
18+
has:
19+
stopBy: end
20+
kind: arguments
21+
all:
22+
- has:
23+
stopBy: end
24+
kind: argument
25+
pattern: $A
26+
- has:
27+
stopBy: end
28+
kind: boolean
29+
pattern: $B
30+
31+
Match_pattern_two_with_integer:
32+
kind: expression_statement
33+
has:
34+
stopBy: end
35+
kind: function_call_expression
36+
pattern: $C
37+
has:
38+
stopBy: end
39+
kind: arguments
40+
all:
41+
- has:
42+
stopBy: end
43+
kind: argument
44+
pattern: $A
45+
- has:
46+
stopBy: end
47+
kind: integer
48+
pattern: $D
49+
50+
Match_pattern_three_with_string:
51+
kind: expression_statement
52+
has:
53+
stopBy: end
54+
kind: function_call_expression
55+
pattern: $C
56+
has:
57+
stopBy: end
58+
kind: arguments
59+
all:
60+
- has:
61+
stopBy: end
62+
kind: argument
63+
pattern: $A
64+
- has:
65+
stopBy: end
66+
kind: argument
67+
has:
68+
stopBy: end
69+
kind: encapsed_string
70+
has:
71+
stopBy: neighbor
72+
pattern: $S
73+
74+
rule:
75+
kind: expression_statement
76+
any:
77+
- matches: Match_pattern_one
78+
- matches: Match_pattern_two_with_integer
79+
- matches: Match_pattern_three_with_string
80+
81+
constraints:
82+
C:
83+
regex: (define|ini_set)
84+
A:
85+
regex: (WP_DEBUG|display_errors)
86+
B:
87+
regex: "true"
88+
D:
89+
regex: "1"
90+
S:
91+
regex: on

‎tests/__snapshots__/drivermanager-hardcoded-secret-java-snapshot.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: drivermanager-hardcoded-secret-java
2+
snapshots:
3+
? |
4+
String password = "a";
5+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password");
6+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", password);
7+
String password = "a";
8+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password");
9+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", password);
10+
: labels:
11+
- source: DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password")
12+
style: primary
13+
start: 40
14+
end: 124
15+
- source: DriverManager
16+
style: secondary
17+
start: 40
18+
end: 53
19+
- source: getConnection
20+
style: secondary
21+
start: 54
22+
end: 67
23+
- source: '"password"'
24+
style: secondary
25+
start: 113
26+
end: 123
27+
- source: ("jdbc:oracle:thin:@localhost:1521:o92", "a", "password")
28+
style: secondary
29+
start: 67
30+
end: 124

‎tests/__snapshots__/search-active-debug-php-snapshot.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: search-active-debug-php
2+
snapshots:
3+
? |
4+
<?php
5+
ini_set("display_errors",1);
6+
define("WP_DEBUG",true);
7+
ini_set("display_errors",true);
8+
ini_set("display_errors","on");
9+
: labels:
10+
- source: ini_set("display_errors",1);
11+
style: primary
12+
start: 6
13+
end: 34
14+
- source: '"display_errors"'
15+
style: secondary
16+
start: 14
17+
end: 30
18+
- source: '1'
19+
style: secondary
20+
start: 31
21+
end: 32
22+
- source: ("display_errors",1)
23+
style: secondary
24+
start: 13
25+
end: 33
26+
- source: ini_set("display_errors",1)
27+
style: secondary
28+
start: 6
29+
end: 33

‎tests/java/drivermanager-hardcoded-secret-java-test.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: drivermanager-hardcoded-secret-java
2+
valid:
3+
- |
4+
Connection conn = DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92","a");
5+
invalid:
6+
- |
7+
String password = "a";
8+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password");
9+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", password);
10+
String password = "a";
11+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password");
12+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", password);

‎tests/php/search-active-debug-php-test.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: search-active-debug-php
2+
valid:
3+
- |
4+
<?php
5+
ini_set("display_errors","on");
6+
ini_set("display_errors","off");
7+
invalid:
8+
- |
9+
<?php
10+
ini_set("display_errors",1);
11+
define("WP_DEBUG",true);
12+
ini_set("display_errors",true);
13+
ini_set("display_errors","on");

0 commit comments

Comments
 (0)