Skip to content

Commit 9e70ab5

Browse files
author
Sakshis
committed
jwt-hardcode-kotlin
1 parent 3f9dec7 commit 9e70ab5

File tree

3 files changed

+468
-0
lines changed

3 files changed

+468
-0
lines changed

‎rules/kotlin/security/jwt-hardcode-kotlin.yml

Lines changed: 321 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,321 @@
1+
id: jwt-hardcode-kotlin
2+
language: kotlin
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. It is
8+
recommended to rotate the secret and retrieve them from a secure secret
9+
vault or Hardware Security Module (HSM), alternatively environment
10+
variables can be used if allowed by your company policy.
11+
note: >-
12+
[CWE-798]: Use of Hard-coded Credentials
13+
[OWASP A03:2021]: Identification and Authentication Failures
14+
[REFERENCES]
15+
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
16+
utils:
17+
match_call_expression_Algorithm:
18+
kind: call_expression
19+
all:
20+
- has:
21+
stopBy: neighbor
22+
kind: navigation_expression
23+
all:
24+
- has:
25+
stopBy: neighbor
26+
kind: simple_identifier
27+
regex: "^Algorithm$"
28+
- has:
29+
stopBy: end
30+
kind: navigation_suffix
31+
has:
32+
stopBy: end
33+
kind: simple_identifier
34+
regex: ^(HMAC256$|HMAC384)$
35+
- has:
36+
stopBy: end
37+
kind: call_suffix
38+
all:
39+
- has:
40+
stopBy: end
41+
kind: value_arguments
42+
- has:
43+
stopBy: end
44+
kind: value_argument
45+
has:
46+
stopBy: end
47+
kind: string_literal
48+
inside:
49+
stopBy: end
50+
kind: property_declaration
51+
inside:
52+
stopBy: end
53+
kind: function_declaration
54+
inside:
55+
stopBy: end
56+
kind: object_declaration
57+
follows:
58+
stopBy: end
59+
kind: import_list
60+
has:
61+
stopBy: end
62+
kind: import_header
63+
has:
64+
stopBy: end
65+
kind: identifier
66+
all:
67+
- has:
68+
stopBy: end
69+
kind: simple_identifier
70+
regex: "^com$"
71+
- has:
72+
stopBy: end
73+
kind: simple_identifier
74+
regex: "^auth0$"
75+
- has:
76+
stopBy: end
77+
kind: simple_identifier
78+
regex: "^jwt$"
79+
- has:
80+
stopBy: end
81+
kind: simple_identifier
82+
regex: "^algorithms$"
83+
- has:
84+
stopBy: end
85+
kind: simple_identifier
86+
regex: "^Algorithm$"
87+
match_call_expression_Algorithm_without_string_literal:
88+
kind: call_expression
89+
all:
90+
- has:
91+
stopBy: neighbor
92+
kind: navigation_expression
93+
all:
94+
- has:
95+
stopBy: neighbor
96+
kind: simple_identifier
97+
regex: "^Algorithm$"
98+
- has:
99+
stopBy: end
100+
kind: navigation_suffix
101+
has:
102+
stopBy: end
103+
kind: simple_identifier
104+
regex: "^HMAC384$"
105+
- has:
106+
stopBy: end
107+
kind: call_suffix
108+
all:
109+
- has:
110+
stopBy: end
111+
kind: value_arguments
112+
- has:
113+
stopBy: end
114+
kind: value_argument
115+
has:
116+
stopBy: end
117+
kind: simple_identifier
118+
pattern: $SECRET
119+
inside:
120+
stopBy: end
121+
kind: property_declaration
122+
inside:
123+
stopBy: end
124+
kind: function_declaration
125+
inside:
126+
stopBy: end
127+
kind: object_declaration
128+
has:
129+
stopBy: end
130+
kind: property_declaration
131+
all:
132+
- has:
133+
stopBy: end
134+
kind: modifiers
135+
- has:
136+
stopBy: end
137+
kind: variable_declaration
138+
has:
139+
stopBy: end
140+
kind: simple_identifier
141+
pattern: $SECRET
142+
follows:
143+
stopBy: end
144+
kind: import_list
145+
any:
146+
- has:
147+
stopBy: end
148+
kind: import_header
149+
has:
150+
stopBy: end
151+
kind: identifier
152+
all:
153+
- has:
154+
stopBy: end
155+
kind: simple_identifier
156+
- has:
157+
stopBy: end
158+
kind: simple_identifier
159+
- has:
160+
stopBy: end
161+
kind: simple_identifier
162+
- has:
163+
stopBy: end
164+
kind: simple_identifier
165+
- has:
166+
stopBy: end
167+
kind: simple_identifier
168+
- has:
169+
stopBy: end
170+
kind: import_header
171+
has:
172+
stopBy: end
173+
kind: identifier
174+
all:
175+
- has:
176+
stopBy: end
177+
kind: simple_identifier
178+
- has:
179+
stopBy: end
180+
kind: simple_identifier
181+
- has:
182+
stopBy: end
183+
kind: simple_identifier
184+
- has:
185+
stopBy: end
186+
kind: simple_identifier
187+
- has:
188+
stopBy: end
189+
kind: simple_identifier
190+
- has:
191+
stopBy: end
192+
kind: simple_identifier
193+
match_call_expression_depend_import:
194+
kind: call_expression
195+
all:
196+
- has:
197+
stopBy: end
198+
kind: simple_identifier
199+
regex: "^HMAC512$"
200+
- has:
201+
stopBy: end
202+
kind: call_suffix
203+
all:
204+
- has:
205+
stopBy: end
206+
kind: value_arguments
207+
- has:
208+
stopBy: end
209+
kind: value_argument
210+
has:
211+
stopBy: end
212+
kind: simple_identifier
213+
inside:
214+
stopBy: end
215+
kind: property_declaration
216+
inside:
217+
stopBy: end
218+
kind: function_declaration
219+
inside:
220+
stopBy: end
221+
kind: object_declaration
222+
follows:
223+
stopBy: end
224+
kind: import_list
225+
has:
226+
stopBy: end
227+
kind: import_header
228+
has:
229+
stopBy: end
230+
kind: identifier
231+
all:
232+
- has:
233+
stopBy: end
234+
kind: simple_identifier
235+
regex: "^com$"
236+
- has:
237+
stopBy: end
238+
kind: simple_identifier
239+
regex: "^auth0$"
240+
- has:
241+
stopBy: end
242+
kind: simple_identifier
243+
regex: "^jwt$"
244+
- has:
245+
stopBy: end
246+
kind: simple_identifier
247+
regex: "^algorithms$"
248+
- has:
249+
stopBy: end
250+
kind: simple_identifier
251+
regex: "^Algorithm$"
252+
- has:
253+
stopBy: end
254+
kind: simple_identifier
255+
regex: "^HMAC512$"
256+
match_call_expression_without_Algorithm:
257+
kind: call_expression
258+
all:
259+
- has:
260+
stopBy: end
261+
kind: simple_identifier
262+
regex: "^HMAC512$"
263+
- has:
264+
stopBy: end
265+
kind: call_suffix
266+
all:
267+
- has:
268+
stopBy: end
269+
kind: value_arguments
270+
- has:
271+
stopBy: end
272+
kind: value_argument
273+
has:
274+
stopBy: end
275+
kind: string_literal
276+
inside:
277+
stopBy: end
278+
kind: property_declaration
279+
inside:
280+
stopBy: end
281+
kind: object_declaration
282+
follows:
283+
stopBy: end
284+
kind: import_list
285+
has:
286+
stopBy: end
287+
kind: import_header
288+
has:
289+
stopBy: end
290+
kind: identifier
291+
all:
292+
- has:
293+
stopBy: end
294+
kind: simple_identifier
295+
regex: "^com$"
296+
- has:
297+
stopBy: end
298+
kind: simple_identifier
299+
regex: "^auth0$"
300+
- has:
301+
stopBy: end
302+
kind: simple_identifier
303+
regex: "^jwt$"
304+
- has:
305+
stopBy: end
306+
kind: simple_identifier
307+
regex: "^algorithms$"
308+
- has:
309+
stopBy: end
310+
kind: simple_identifier
311+
regex: "^Algorithm$"
312+
- has:
313+
stopBy: end
314+
kind: simple_identifier
315+
regex: "^HMAC512$"
316+
rule:
317+
any:
318+
- matches: match_call_expression_Algorithm
319+
- matches: match_call_expression_Algorithm_without_string_literal
320+
- matches: match_call_expression_depend_import
321+
- matches: match_call_expression_without_Algorithm

0 commit comments

Comments
 (0)