Skip to content

Commit a26f887

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add security rules for detecting hardcoded tokens and empty passwords (#143)
* removed missing-secure-java * httponly-false-csharp * use-of-md5-digest-utils-java * removing use-of-md5-digest-utils and httponly-false-csharp * python-elasticsearch-hardcoded-bearer-auth-python * python-requests-empty-password-python * Testing * Testing 2 * Added invalid test case to python-requests-empty-password-python test file --------- Co-authored-by: Sakshis <sakshil@abc.com>
1 parent 7f9f1af commit a26f887

6 files changed

+215
-0
lines changed

‎rules/python/security/python-elasticsearch-hardcoded-bearer-auth-python.yml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
id: python-elasticsearch-hardcoded-bearer-auth-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
15+
ast-grep-essentials: true
16+
17+
utils:
18+
elasticsearch.Elasticsearch(..., bearer_auth="...",...):
19+
# elasticsearch.Elasticsearch(..., bearer_auth="...",...)
20+
kind: call
21+
all:
22+
- has:
23+
stopBy: neighbor
24+
kind: attribute
25+
regex: ^elasticsearch.Elasticsearch$
26+
- has:
27+
stopBy: neighbor
28+
kind: argument_list
29+
all:
30+
- has:
31+
stopBy: end
32+
kind: keyword_argument
33+
all:
34+
- has:
35+
stopBy: neighbor
36+
kind: identifier
37+
regex: ^bearer_auth$
38+
- has:
39+
stopBy: neighbor
40+
kind: string
41+
has:
42+
stopBy: end
43+
kind: string_content
44+
- not:
45+
has:
46+
stopBy: end
47+
kind: keyword_argument
48+
all:
49+
- has:
50+
stopBy: neighbor
51+
kind: identifier
52+
regex: ^bearer_auth$
53+
- has:
54+
stopBy: neighbor
55+
kind: string
56+
not:
57+
has:
58+
stopBy: end
59+
kind: string_content
60+
rule:
61+
kind: call
62+
matches: elasticsearch.Elasticsearch(..., bearer_auth="...",...)
63+
not:
64+
all:
65+
- has:
66+
stopBy: end
67+
kind: ERROR
68+
- inside:
69+
stopBy: end
70+
kind: ERROR
71+

‎rules/python/security/python-requests-empty-password-python.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
id: python-requests-empty-password-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
The application creates a database connection with an empty password.
6+
This can lead to unauthorized access by either an internal or external
7+
malicious actor. To prevent this vulnerability, enforce authentication
8+
when connecting to a database by using environment variables to securely
9+
provide credentials or retrieving them from a secure vault or HSM
10+
(Hardware Security Module).
11+
note: >-
12+
[CWE-287] Improper Authentication.
13+
[REFERENCES]
14+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
16+
ast-grep-essentials: true
17+
18+
utils:
19+
requests.auth.HTTPBasicAuth($USER,"",...):
20+
kind: call
21+
all:
22+
- has:
23+
stopBy: neighbor
24+
kind: attribute
25+
regex: ^requests.auth.HTTPBasicAuth$|^requests.auth.HTTPDigestAuth$|^requests.auth.HTTPProxyAuth$
26+
- has:
27+
stopBy: neighbor
28+
kind: argument_list
29+
has:
30+
stopBy: neighbor
31+
kind: string
32+
nthChild: 2
33+
not:
34+
has:
35+
stopBy: end
36+
kind: string_content
37+
# - not:
38+
# inside:
39+
# stopBy: end
40+
# kind: argument_list
41+
# follows:
42+
# stopBy: end
43+
# kind: attribute
44+
# regex: ^requests.auth.HTTPBasicAuth$|^requests.auth.HTTPDigestAuth$|^requests.auth.HTTPProxyAuth$
45+
rule:
46+
kind: call
47+
matches: requests.auth.HTTPBasicAuth($USER,"",...)
48+
not:
49+
all:
50+
- has:
51+
stopBy: end
52+
kind: ERROR
53+
- inside:
54+
stopBy: end
55+
kind: ERROR
56+

‎tests/__snapshots__/python-elasticsearch-hardcoded-bearer-auth-python-snapshot.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
id: python-elasticsearch-hardcoded-bearer-auth-python
2+
snapshots:
3+
? |
4+
es = elasticsearch.Elasticsearch(
5+
"https://localhost:9200",
6+
bearer_auth="token-value"
7+
)
8+
: labels:
9+
- source: |-
10+
elasticsearch.Elasticsearch(
11+
"https://localhost:9200",
12+
bearer_auth="token-value"
13+
)
14+
style: primary
15+
start: 5
16+
end: 91
17+
- source: elasticsearch.Elasticsearch
18+
style: secondary
19+
start: 5
20+
end: 32
21+
- source: bearer_auth
22+
style: secondary
23+
start: 64
24+
end: 75
25+
- source: token-value
26+
style: secondary
27+
start: 77
28+
end: 88
29+
- source: '"token-value"'
30+
style: secondary
31+
start: 76
32+
end: 89
33+
- source: bearer_auth="token-value"
34+
style: secondary
35+
start: 64
36+
end: 89
37+
- source: |-
38+
(
39+
"https://localhost:9200",
40+
bearer_auth="token-value"
41+
)
42+
style: secondary
43+
start: 32
44+
end: 91

‎tests/__snapshots__/python-requests-empty-password-python-snapshot.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: python-requests-empty-password-python
2+
snapshots:
3+
requests.get('https://httpbin.org/basic-auth/user/pass', auth=requests.auth.HTTPBasicAuth('user', '')):
4+
labels:
5+
- source: requests.auth.HTTPBasicAuth('user', '')
6+
style: primary
7+
start: 62
8+
end: 101
9+
- source: requests.auth.HTTPBasicAuth
10+
style: secondary
11+
start: 62
12+
end: 89
13+
- source: ''''''
14+
style: secondary
15+
start: 98
16+
end: 100
17+
- source: ('user', '')
18+
style: secondary
19+
start: 89
20+
end: 101

‎tests/python/python-elasticsearch-hardcoded-bearer-auth-python-test.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
id: python-elasticsearch-hardcoded-bearer-auth-python
2+
valid:
3+
- |
4+
es = elasticsearch.Elasticsearch(
5+
"https://localhost:9200",
6+
bearer_auth=os.env["token-value"]
7+
)
8+
9+
invalid:
10+
- |
11+
es = elasticsearch.Elasticsearch(
12+
"https://localhost:9200",
13+
bearer_auth="token-value"
14+
)
15+

‎tests/python/python-requests-empty-password-python-test.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
id: python-requests-empty-password-python
2+
valid:
3+
- |
4+
requests.get('https://httpbin.org/basic-auth/user/pass', auth=requests.auth.HTTPBasicAuth('user', os.getenv('pass'))
5+
invalid:
6+
- |
7+
requests.get('https://httpbin.org/basic-auth/user/pass', auth=requests.auth.HTTPBasicAuth('user', ''))
8+
- |
9+
requests.get('https://httpbin.org/basic-auth/user/pass', auth=requests.auth.HTTPBasicAuth('username', ''))

0 commit comments

Comments
 (0)