Skip to content

Commit 87da17c

Browse files
ESS-ENNESS-ENN
committed
rabbit-hardcoded-secret-swift
1 parent c125a42 commit 87da17c

File tree

3 files changed

+578
-0
lines changed

3 files changed

+578
-0
lines changed

‎rules/swift/security/rabbit-hardcoded-secret-swift.yml

Lines changed: 285 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,285 @@
1+
id: rabbit-hardcoded-secret-swift
2+
severity: warning
3+
language: swift
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
utils:
15+
match_pattern_try_expression_directly:
16+
kind: try_expression
17+
has:
18+
stopBy: neighbor
19+
kind: call_expression
20+
all:
21+
- has:
22+
stopBy: end
23+
kind: simple_identifier
24+
regex: "^Rabbit$"
25+
- has:
26+
stopBy: end
27+
kind: call_suffix
28+
has:
29+
stopBy: end
30+
kind: value_arguments
31+
has:
32+
stopBy: end
33+
kind: value_argument
34+
all:
35+
- has:
36+
stopBy: end
37+
kind: simple_identifier
38+
regex: "^key$"
39+
- has:
40+
stopBy: neighbor
41+
kind: line_string_literal
42+
has:
43+
stopBy: end
44+
kind: line_str_text
45+
46+
match_pattern_Rabbit_statement_directly:
47+
kind: call_expression
48+
all:
49+
- has:
50+
stopBy: end
51+
kind: simple_identifier
52+
regex: "^Rabbit$"
53+
- has:
54+
stopBy: end
55+
kind: call_suffix
56+
has:
57+
stopBy: end
58+
kind: value_arguments
59+
has:
60+
stopBy: end
61+
kind: value_argument
62+
all:
63+
- has:
64+
stopBy: end
65+
kind: simple_identifier
66+
regex: "^key$"
67+
- has:
68+
stopBy: end
69+
kind: line_string_literal
70+
has:
71+
stopBy: neighbor
72+
kind: line_str_text
73+
- not:
74+
inside:
75+
stopBy: end
76+
kind: try_expression
77+
78+
match_pattern_Rabbit_expression_with_instance:
79+
kind: call_expression
80+
all:
81+
- has:
82+
stopBy: end
83+
kind: simple_identifier
84+
regex: "^Rabbit$"
85+
- has:
86+
stopBy: end
87+
kind: call_suffix
88+
has:
89+
stopBy: end
90+
kind: value_arguments
91+
has:
92+
stopBy: end
93+
kind: value_argument
94+
all:
95+
- has:
96+
stopBy: end
97+
kind: simple_identifier
98+
regex: "^key$"
99+
- has:
100+
stopBy: end
101+
kind: simple_identifier
102+
nthChild: 2
103+
pattern: $R
104+
- not:
105+
inside:
106+
stopBy: neighbor
107+
kind: try_expression
108+
- follows:
109+
stopBy: end
110+
kind: property_declaration
111+
all:
112+
- has:
113+
stopBy: end
114+
kind: pattern
115+
has:
116+
stopBy: end
117+
kind: simple_identifier
118+
pattern: $R
119+
- has:
120+
stopBy: neighbor
121+
kind: call_expression
122+
pattern: Array("$$$".utf8)
123+
124+
match_pattern_try_expression_with_instance:
125+
kind: try_expression
126+
all:
127+
- has:
128+
stopBy: neighbor
129+
kind: call_expression
130+
all:
131+
- has:
132+
stopBy: end
133+
kind: simple_identifier
134+
regex: "^Rabbit$"
135+
- has:
136+
stopBy: end
137+
kind: call_suffix
138+
has:
139+
stopBy: end
140+
kind: value_arguments
141+
has:
142+
stopBy: end
143+
kind: value_argument
144+
all:
145+
- has:
146+
stopBy: end
147+
kind: simple_identifier
148+
regex: "^key$"
149+
- has:
150+
stopBy: end
151+
kind: simple_identifier
152+
nthChild: 2
153+
pattern: $R
154+
- follows:
155+
stopBy: end
156+
kind: property_declaration
157+
all:
158+
- has:
159+
stopBy: end
160+
kind: pattern
161+
has:
162+
stopBy: end
163+
kind: simple_identifier
164+
pattern: $R
165+
- has:
166+
stopBy: end
167+
kind: call_expression
168+
pattern: Array("$$$".utf8)
169+
170+
match_pattern_Rabbit_expression_with_utf8:
171+
kind: call_expression
172+
all:
173+
- has:
174+
stopBy: neighbor
175+
kind: simple_identifier
176+
regex: "^Blowfish$"
177+
- has:
178+
stopBy: neighbor
179+
kind: call_suffix
180+
has:
181+
stopBy: end
182+
kind: value_argument
183+
all:
184+
- has:
185+
stopBy: end
186+
kind: simple_identifier
187+
regex: "^key$"
188+
- has:
189+
stopBy: end
190+
kind: call_expression
191+
all:
192+
- has:
193+
stopBy: neighbor
194+
kind: simple_identifier
195+
regex: "^Array$"
196+
- has:
197+
stopBy: neighbor
198+
kind: call_suffix
199+
has:
200+
stopBy: end
201+
kind: value_argument
202+
has:
203+
stopBy: neighbor
204+
kind: navigation_expression
205+
all:
206+
- has:
207+
stopBy: neighbor
208+
kind: line_string_literal
209+
has:
210+
stopBy: neighbor
211+
kind: line_str_text
212+
- has:
213+
stopBy: neighbor
214+
kind: navigation_suffix
215+
has:
216+
stopBy: neighbor
217+
kind: simple_identifier
218+
regex: "^utf8$"
219+
220+
match_pattern_try_expression_with_utf8:
221+
kind: try_expression
222+
has:
223+
stopBy: end
224+
kind: call_expression
225+
all:
226+
- has:
227+
stopBy: end
228+
kind: simple_identifier
229+
regex: "^Rabbit$"
230+
- has:
231+
stopBy: end
232+
kind: call_suffix
233+
has:
234+
stopBy: end
235+
kind: value_argument
236+
all:
237+
- has:
238+
stopBy: end
239+
kind: simple_identifier
240+
regex: "^key$"
241+
- has:
242+
stopBy: end
243+
kind: call_expression
244+
all:
245+
- has:
246+
stopBy: end
247+
kind: simple_identifier
248+
regex: "^Array$"
249+
- has:
250+
stopBy: end
251+
kind: call_suffix
252+
has:
253+
stopBy: end
254+
kind: value_argument
255+
has:
256+
stopBy: end
257+
kind: navigation_expression
258+
all:
259+
- has:
260+
stopBy: end
261+
kind: line_string_literal
262+
has:
263+
stopBy: end
264+
kind: line_str_text
265+
- has:
266+
stopBy: end
267+
kind: navigation_suffix
268+
has:
269+
stopBy: end
270+
kind: simple_identifier
271+
regex: "^utf8$"
272+
273+
rule:
274+
any:
275+
- kind: try_expression
276+
any:
277+
- matches: match_pattern_try_expression_directly
278+
- matches: match_pattern_try_expression_with_instance
279+
- matches: match_pattern_try_expression_with_utf8
280+
281+
- kind: call_expression
282+
any:
283+
- matches: match_pattern_Rabbit_statement_directly
284+
- matches: match_pattern_Rabbit_expression_with_instance
285+
- matches: match_pattern_Rabbit_expression_with_utf8

0 commit comments

Comments
 (0)