Skip to content

Commit 781af4d

Browse files
author
Sakshis
committed
python-neo4j-hardcoded-secret-auth-python
1 parent 4659d6b commit 781af4d

File tree

3 files changed

+534
-0
lines changed

3 files changed

+534
-0
lines changed

‎rules/python/security/python-neo4j-hardcoded-secret-auth-python.yml

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
id: python-neo4j-hardcoded-secret-auth-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
15+
ast-grep-essentials: true
16+
17+
utils:
18+
define_string:
19+
kind: string
20+
all:
21+
- has:
22+
kind: string_start
23+
nthChild: 1
24+
- has:
25+
kind: string_content
26+
nthChild: 2
27+
- has:
28+
kind: string_end
29+
nthChild: 3
30+
31+
define_password:
32+
any:
33+
- matches: define_string
34+
- kind: identifier
35+
pattern: $PWD_IDENTIFIER
36+
inside:
37+
stopBy: end
38+
follows:
39+
stopBy: end
40+
kind: expression_statement
41+
has:
42+
stopBy: end
43+
kind: assignment
44+
nthChild: 1
45+
all:
46+
- has:
47+
nthChild: 1
48+
kind: identifier
49+
field: left
50+
pattern: $PWD_IDENTIFIER
51+
- has:
52+
nthChild: 2
53+
matches: define_string
54+
55+
rule:
56+
any:
57+
# basic_auth and custom_auth
58+
- kind: call
59+
any:
60+
- kind: call
61+
has:
62+
nthChild: 1
63+
kind: attribute
64+
regex: ^(neo4j.custom_auth|neo4j.basic_auth)$
65+
precedes:
66+
kind: argument_list
67+
has:
68+
nthChild:
69+
position: 2
70+
ofRule:
71+
not:
72+
kind: comment
73+
matches: define_password
74+
- kind: call
75+
any:
76+
- kind: call
77+
has:
78+
nthChild: 1
79+
kind: identifier
80+
regex: ^basic_auth$
81+
precedes:
82+
kind: argument_list
83+
has:
84+
nthChild:
85+
position: 2
86+
ofRule:
87+
not:
88+
kind: comment
89+
matches: define_password
90+
91+
inside:
92+
stopBy: end
93+
follows:
94+
stopBy: end
95+
kind: import_from_statement
96+
all:
97+
- has:
98+
nthChild: 1
99+
kind: dotted_name
100+
field: module_name
101+
regex: ^neo4j$
102+
precedes:
103+
stopBy: end
104+
kind: dotted_name
105+
regex: ^basic_auth$
106+
- kind: call
107+
any:
108+
- kind: call
109+
has:
110+
nthChild: 1
111+
kind: identifier
112+
regex: ^custom_auth$
113+
precedes:
114+
kind: argument_list
115+
has:
116+
nthChild:
117+
position: 2
118+
ofRule:
119+
not:
120+
kind: comment
121+
matches: define_password
122+
123+
inside:
124+
stopBy: end
125+
follows:
126+
stopBy: end
127+
kind: import_from_statement
128+
all:
129+
- has:
130+
nthChild: 1
131+
kind: dotted_name
132+
field: module_name
133+
regex: ^neo4j$
134+
precedes:
135+
stopBy: end
136+
kind: dotted_name
137+
regex: ^custom_auth$
138+
139+
# kerberos_auth and bearer_auth
140+
- kind: call
141+
any:
142+
- kind: call
143+
has:
144+
nthChild: 1
145+
kind: attribute
146+
regex: ^(neo4j.kerberos_auth|neo4j.bearer_auth)$
147+
precedes:
148+
kind: argument_list
149+
has:
150+
nthChild:
151+
position: 1
152+
ofRule:
153+
not:
154+
kind: comment
155+
matches: define_password
156+
- kind: call
157+
any:
158+
- kind: call
159+
has:
160+
nthChild: 1
161+
kind: identifier
162+
regex: ^kerberos_auth$
163+
precedes:
164+
kind: argument_list
165+
has:
166+
nthChild:
167+
position: 1
168+
ofRule:
169+
not:
170+
kind: comment
171+
matches: define_password
172+
173+
inside:
174+
stopBy: end
175+
follows:
176+
stopBy: end
177+
kind: import_from_statement
178+
all:
179+
- has:
180+
nthChild: 1
181+
kind: dotted_name
182+
field: module_name
183+
regex: ^neo4j$
184+
precedes:
185+
stopBy: end
186+
kind: dotted_name
187+
regex: ^kerberos_auth$
188+
- kind: call
189+
any:
190+
- kind: call
191+
has:
192+
nthChild: 1
193+
kind: identifier
194+
regex: ^bearer_auth$
195+
precedes:
196+
kind: argument_list
197+
has:
198+
nthChild:
199+
position: 1
200+
ofRule:
201+
not:
202+
kind: comment
203+
matches: define_password
204+
205+
inside:
206+
stopBy: end
207+
follows:
208+
stopBy: end
209+
kind: import_from_statement
210+
all:
211+
- has:
212+
nthChild: 1
213+
kind: dotted_name
214+
field: module_name
215+
regex: ^neo4j$
216+
precedes:
217+
stopBy: end
218+
kind: dotted_name
219+
regex: ^bearer_auth$

0 commit comments

Comments
 (0)