Skip to content

Commit 87c8d48

Browse files
ESS-ENNESS-ENN
committed
hkdf-hardcoded-secret-swift
1 parent 0be8d6c commit 87c8d48

File tree

3 files changed

+650
-0
lines changed

3 files changed

+650
-0
lines changed

‎rules/swift/security/hkdf-hardcoded-secret-swift.yml

Lines changed: 309 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,309 @@
1+
id: hkdf-hardcoded-secret-swift
2+
severity: warning
3+
language: swift
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
utils:
15+
16+
match_pattern_HKDF_expression_with_instance:
17+
kind: call_expression
18+
all:
19+
- has:
20+
stopBy: neighbor
21+
kind: simple_identifier
22+
regex: '^HKDF$'
23+
- has:
24+
stopBy: neighbor
25+
kind: call_suffix
26+
has:
27+
stopBy: neighbor
28+
kind: value_arguments
29+
has:
30+
stopBy: neighbor
31+
kind: value_argument
32+
all:
33+
- has:
34+
stopBy: neighbor
35+
kind: simple_identifier
36+
regex: '^password$'
37+
- has:
38+
stopBy: end
39+
kind: simple_identifier
40+
nthChild: 2
41+
pattern: $R
42+
- not:
43+
inside:
44+
stopBy: neighbor
45+
kind: try_expression
46+
- inside:
47+
stopBy: end
48+
kind: property_declaration
49+
follows:
50+
stopBy: end
51+
kind: property_declaration
52+
all:
53+
- has:
54+
stopBy: end
55+
kind: pattern
56+
has:
57+
stopBy: end
58+
kind: simple_identifier
59+
pattern: $R
60+
- has:
61+
stopBy: neighbor
62+
kind: call_expression
63+
pattern: Array("$$$".utf8)
64+
65+
match_pattern_try_expression_with_instance:
66+
kind: try_expression
67+
all:
68+
- has:
69+
stopBy: neighbor
70+
kind: call_expression
71+
all:
72+
- has:
73+
stopBy: neighbor
74+
kind: simple_identifier
75+
regex: '^HKDF$'
76+
- has:
77+
stopBy: neighbor
78+
kind: call_suffix
79+
has:
80+
stopBy: neighbor
81+
kind: value_arguments
82+
has:
83+
stopBy: neighbor
84+
kind: value_argument
85+
all:
86+
- has:
87+
stopBy: neighbor
88+
kind: simple_identifier
89+
regex: '^password$'
90+
- has:
91+
stopBy: end
92+
kind: simple_identifier
93+
nthChild: 2
94+
pattern: $R
95+
- inside:
96+
stopBy: end
97+
kind: property_declaration
98+
follows:
99+
stopBy: end
100+
kind: property_declaration
101+
all:
102+
- has:
103+
stopBy: end
104+
kind: pattern
105+
has:
106+
stopBy: end
107+
kind: simple_identifier
108+
pattern: $R
109+
- has:
110+
stopBy: neighbor
111+
kind: call_expression
112+
pattern: Array("$$$".utf8)
113+
114+
match_pattern_HKDF_expression_directly:
115+
kind: call_expression
116+
all:
117+
- has:
118+
stopBy: neighbor
119+
kind: simple_identifier
120+
regex: '^HKDF$'
121+
- has:
122+
stopBy: neighbor
123+
kind: call_suffix
124+
all:
125+
- has:
126+
stopBy: neighbor
127+
kind: value_arguments
128+
has:
129+
stopBy: end
130+
kind: value_argument
131+
all:
132+
- has:
133+
stopBy: end
134+
kind: simple_identifier
135+
regex: '^password$'
136+
- has:
137+
stopBy: neighbor
138+
kind: line_string_literal
139+
has:
140+
stopBy: neighbor
141+
kind: line_str_text
142+
- not:
143+
inside:
144+
stopBy: end
145+
kind: try_expression
146+
147+
match_pattern_try_expression_directly:
148+
kind: try_expression
149+
has:
150+
stopBy: neighbor
151+
kind: call_expression
152+
all:
153+
- has:
154+
stopBy: neighbor
155+
kind: simple_identifier
156+
regex: '^HKDF$'
157+
- has:
158+
stopBy: neighbor
159+
kind: call_suffix
160+
all:
161+
- has:
162+
stopBy: neighbor
163+
kind: value_arguments
164+
has:
165+
stopBy: end
166+
kind: value_argument
167+
all:
168+
- has:
169+
stopBy: end
170+
kind: simple_identifier
171+
regex: '^password$'
172+
- has:
173+
stopBy: neighbor
174+
kind: line_string_literal
175+
has:
176+
stopBy: neighbor
177+
kind: line_str_text
178+
179+
match_pattern_HKDF_expression_with_utf8:
180+
kind: call_expression
181+
all:
182+
- has:
183+
stopBy: neighbor
184+
kind: simple_identifier
185+
regex: '^HKDF$'
186+
- has:
187+
stopBy: neighbor
188+
kind: call_suffix
189+
has:
190+
stopBy: neighbor
191+
kind: value_arguments
192+
has:
193+
stopBy: end
194+
kind: value_argument
195+
all:
196+
- has:
197+
stopBy: end
198+
kind: simple_identifier
199+
regex: '^password$'
200+
- has:
201+
stopBy: neighbor
202+
kind: call_expression
203+
all:
204+
- has:
205+
stopBy: neighbor
206+
kind: simple_identifier
207+
regex: '^Array$'
208+
- has:
209+
stopBy: neighbor
210+
kind: call_suffix
211+
has:
212+
stopBy: neighbor
213+
kind: value_arguments
214+
has:
215+
stopBy: neighbor
216+
kind: value_argument
217+
has:
218+
stopBy: neighbor
219+
kind: navigation_expression
220+
all:
221+
- has:
222+
stopBy: neighbor
223+
kind: line_string_literal
224+
has:
225+
stopBy: neighbor
226+
kind: line_str_text
227+
- has:
228+
stopBy: neighbor
229+
kind: navigation_suffix
230+
has:
231+
stopBy: neighbor
232+
kind: simple_identifier
233+
regex: '^utf8$'
234+
- not:
235+
inside:
236+
stopBy: end
237+
kind: try_expression
238+
239+
match_pattern_try_expression_with_utf8:
240+
kind: try_expression
241+
has:
242+
stopBy: neighbor
243+
kind: call_expression
244+
all:
245+
- has:
246+
stopBy: neighbor
247+
kind: simple_identifier
248+
regex: '^HKDF$'
249+
- has:
250+
stopBy: neighbor
251+
kind: call_suffix
252+
has:
253+
stopBy: neighbor
254+
kind: value_arguments
255+
has:
256+
stopBy: end
257+
kind: value_argument
258+
all:
259+
- has:
260+
stopBy: end
261+
kind: simple_identifier
262+
regex: '^password$'
263+
- has:
264+
stopBy: neighbor
265+
kind: call_expression
266+
all:
267+
- has:
268+
stopBy: neighbor
269+
kind: simple_identifier
270+
regex: '^Array$'
271+
- has:
272+
stopBy: neighbor
273+
kind: call_suffix
274+
has:
275+
stopBy: neighbor
276+
kind: value_arguments
277+
has:
278+
stopBy: neighbor
279+
kind: value_argument
280+
has:
281+
stopBy: neighbor
282+
kind: navigation_expression
283+
all:
284+
- has:
285+
stopBy: neighbor
286+
kind: line_string_literal
287+
has:
288+
stopBy: neighbor
289+
kind: line_str_text
290+
- has:
291+
stopBy: neighbor
292+
kind: navigation_suffix
293+
has:
294+
stopBy: neighbor
295+
kind: simple_identifier
296+
regex: '^utf8$'
297+
298+
rule:
299+
any:
300+
- kind: try_expression
301+
any:
302+
- matches: match_pattern_try_expression_directly
303+
- matches: match_pattern_try_expression_with_instance
304+
- matches: match_pattern_try_expression_with_utf8
305+
- kind: call_expression
306+
any:
307+
- matches: match_pattern_HKDF_expression_directly
308+
- matches: match_pattern_HKDF_expression_with_instance
309+
- matches: match_pattern_HKDF_expression_with_utf8

0 commit comments

Comments
 (0)