Skip to content

Commit 991fa00

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add Peewee ORM security rules for empty passwords and hard-coded secrets (#140)
* removed missing-secure-java * httponly-false-csharp * use-of-md5-digest-utils-java * removing use-of-md5-digest-utils and httponly-false-csharp * python-peewee-pg-empty-password-python * python-peewee-pg-hardcoded-secret-python --------- Co-authored-by: Sakshis <sakshil@abc.com>
1 parent 05a7c30 commit 991fa00

6 files changed

+189
-0
lines changed

‎rules/python/security/python-peewee-pg-empty-password-python.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
id: python-peewee-pg-empty-password-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
The application creates a database connection with an empty password.
6+
This can lead to unauthorized access by either an internal or external
7+
malicious actor. To prevent this vulnerability, enforce authentication
8+
when connecting to a database by using environment variables to securely
9+
provide credentials or retrieving them from a secure vault or HSM
10+
(Hardware Security Module).
11+
note: >-
12+
[CWE-287] Improper Authentication.
13+
[REFERENCES]
14+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
16+
ast-grep-essentials: true
17+
18+
utils:
19+
$DB(..., password="...",...):
20+
# $DB(..., password="...",...)
21+
kind: call
22+
all:
23+
- has:
24+
stopBy: neighbor
25+
pattern: $DB
26+
regex: ^PostgresqlDatabase$|6peewee.PostgresqlDatabase$|^PostgresqlExtDatabase|playhouse.postgres_ext.PostgresqlExtDatabase$|^PooledPostgresqlDatabase$|^playhouse.pool.PooledPostgresqlDatabase$|^CockroachDatabase$|^playhouse.cockroachdb.CockroachDatabase$|^PooledCockroachDatabase$|^playhouse.cockroachdb.PooledCockroachDatabase$
27+
- has:
28+
stopBy: neighbor
29+
kind: argument_list
30+
has:
31+
stopBy: neighbor
32+
kind: keyword_argument
33+
all:
34+
- has:
35+
stopBy: neighbor
36+
kind: identifier
37+
regex: ^password$|^passwd$
38+
- has:
39+
stopBy: neighbor
40+
kind: string
41+
not:
42+
has:
43+
stopBy: neighbor
44+
kind: string_content
45+
rule:
46+
kind: call
47+
matches: $DB(..., password="...",...)
48+
all:
49+
- not:
50+
has:
51+
stopBy: end
52+
kind: ERROR
53+
- not:
54+
inside:
55+
stopBy: end
56+
kind: ERROR

‎rules/python/security/python-peewee-pg-hardcoded-secret-python.yml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
id: python-peewee-pg-hardcoded-secret-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
15+
ast-grep-essentials: true
16+
17+
utils:
18+
$DB(..., password="...",...):
19+
# $DB(..., password="...",...)
20+
kind: call
21+
all:
22+
- has:
23+
stopBy: neighbor
24+
pattern: $DB
25+
regex: ^PostgresqlDatabase$|6peewee.PostgresqlDatabase$|^PostgresqlExtDatabase|playhouse.postgres_ext.PostgresqlExtDatabase$|^PooledPostgresqlDatabase$|^playhouse.pool.PooledPostgresqlDatabase$|^CockroachDatabase$|^playhouse.cockroachdb.CockroachDatabase$|^PooledCockroachDatabase$|^playhouse.cockroachdb.PooledCockroachDatabase$
26+
- has:
27+
stopBy: neighbor
28+
kind: argument_list
29+
has:
30+
stopBy: neighbor
31+
kind: keyword_argument
32+
all:
33+
- has:
34+
stopBy: neighbor
35+
kind: identifier
36+
regex: ^password$|^passwd$
37+
- has:
38+
stopBy: neighbor
39+
kind: string
40+
has:
41+
stopBy: neighbor
42+
kind: string_content
43+
rule:
44+
kind: call
45+
matches: $DB(..., password="...",...)
46+
all:
47+
- not:
48+
has:
49+
stopBy: end
50+
kind: ERROR
51+
- not:
52+
inside:
53+
stopBy: end
54+
kind: ERROR
55+

‎tests/__snapshots__/python-peewee-pg-empty-password-python-snapshot.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: python-peewee-pg-empty-password-python
2+
snapshots:
3+
? |
4+
pg_db1 = PostgresqlDatabase('my_app', user='postgres', password='', host='10.1.0.9', port=5432)
5+
: labels:
6+
- source: PostgresqlDatabase('my_app', user='postgres', password='', host='10.1.0.9', port=5432)
7+
style: primary
8+
start: 9
9+
end: 95
10+
- source: PostgresqlDatabase
11+
style: secondary
12+
start: 9
13+
end: 27
14+
- source: password
15+
style: secondary
16+
start: 55
17+
end: 63
18+
- source: ''''''
19+
style: secondary
20+
start: 64
21+
end: 66
22+
- source: password=''
23+
style: secondary
24+
start: 55
25+
end: 66
26+
- source: ('my_app', user='postgres', password='', host='10.1.0.9', port=5432)
27+
style: secondary
28+
start: 27
29+
end: 95

‎tests/__snapshots__/python-peewee-pg-hardcoded-secret-python-snapshot.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
id: python-peewee-pg-hardcoded-secret-python
2+
snapshots:
3+
? |
4+
pg_db1 = PostgresqlDatabase('my_app', user='postgres', password='password', host='10.1.0.9', port=5432)
5+
: labels:
6+
- source: PostgresqlDatabase('my_app', user='postgres', password='password', host='10.1.0.9', port=5432)
7+
style: primary
8+
start: 9
9+
end: 103
10+
- source: PostgresqlDatabase
11+
style: secondary
12+
start: 9
13+
end: 27
14+
- source: password
15+
style: secondary
16+
start: 55
17+
end: 63
18+
- source: password
19+
style: secondary
20+
start: 65
21+
end: 73
22+
- source: '''password'''
23+
style: secondary
24+
start: 64
25+
end: 74
26+
- source: password='password'
27+
style: secondary
28+
start: 55
29+
end: 74
30+
- source: ('my_app', user='postgres', password='password', host='10.1.0.9', port=5432)
31+
style: secondary
32+
start: 27
33+
end: 103

‎tests/python/python-peewee-pg-empty-password-python-test.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
id: python-peewee-pg-empty-password-python
2+
valid:
3+
- |
4+
mysql_db1 = MySQLDatabe('my_app', user='app', password=os.env['db_password'], host='10.1.0.8', port=3306)
5+
invalid:
6+
- |
7+
pg_db1 = PostgresqlDatabase('my_app', user='postgres', password='', host='10.1.0.9', port=5432)
8+

‎tests/python/python-peewee-pg-hardcoded-secret-python-test.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
id: python-peewee-pg-hardcoded-secret-python
2+
valid:
3+
- |
4+
mysql_db1 = MySQLDatabe('my_app', user='app', password=os.env['db_password'], host='10.1.0.8', port=3306)
5+
invalid:
6+
- |
7+
pg_db1 = PostgresqlDatabase('my_app', user='postgres', password='password', host='10.1.0.9', port=5432)
8+

0 commit comments

Comments
 (0)