Skip to content

Commit b41cef4

Browse files
ESS-ENNESS-ENN
committed
openai-hardcoded-secret-go
1 parent b2765b8 commit b41cef4

File tree

3 files changed

+274
-0
lines changed

3 files changed

+274
-0
lines changed

‎rules/go/security/openai-hardcoded-secret-go.yml

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
id: openai-hardcoded-secret-go
2+
language: go
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. It is
8+
recommended to rotate the secret and retrieve them from a secure secret
9+
vault or Hardware Security Module (HSM), alternatively environment
10+
variables can be used if allowed by your company policy.
11+
note: >-
12+
[CWE-798] Use of Hard-coded Credentials.
13+
[REFERENCES]
14+
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
15+
16+
ast-grep-essentials: true
17+
18+
utils:
19+
MATCH_openai.NewClient:
20+
kind: call_expression
21+
all:
22+
- has:
23+
stopBy: neighbor
24+
kind: selector_expression
25+
all:
26+
- has:
27+
stopBy: neighbor
28+
kind: identifier
29+
regex: ^openai$
30+
- has:
31+
stopBy: neighbor
32+
kind: field_identifier
33+
regex: ^NewClient$
34+
- has:
35+
stopBy: neighbor
36+
kind: argument_list
37+
has:
38+
kind: interpreted_string_literal
39+
has:
40+
kind: interpreted_string_literal_content
41+
nthChild:
42+
position: 1
43+
ofRule:
44+
not:
45+
kind: comment
46+
not:
47+
has:
48+
nthChild:
49+
position: 2
50+
ofRule:
51+
not:
52+
kind: comment
53+
- any:
54+
- inside:
55+
stopBy: end
56+
follows:
57+
stopBy: end
58+
has:
59+
stopBy: end
60+
kind: import_spec
61+
regex: "github.com/sashabaranov/go-openai"
62+
- follows:
63+
stopBy: end
64+
has:
65+
stopBy: end
66+
kind: import_spec
67+
regex: "github.com/sashabaranov/go-openai"
68+
MATCH_openai.NewClient_instance:
69+
kind: call_expression
70+
all:
71+
- has:
72+
stopBy: neighbor
73+
kind: selector_expression
74+
all:
75+
- has:
76+
stopBy: neighbor
77+
kind: identifier
78+
regex: ^openai$
79+
- has:
80+
stopBy: neighbor
81+
kind: field_identifier
82+
regex: ^NewClient$
83+
- has:
84+
stopBy: neighbor
85+
kind: argument_list
86+
has:
87+
kind: identifier
88+
pattern: $VAR
89+
nthChild:
90+
position: 1
91+
ofRule:
92+
not:
93+
kind: comment
94+
not:
95+
has:
96+
nthChild:
97+
position: 2
98+
ofRule:
99+
not:
100+
kind: comment
101+
- any:
102+
- inside:
103+
stopBy: end
104+
follows:
105+
stopBy: end
106+
has:
107+
stopBy: end
108+
kind: import_spec
109+
regex: "github.com/sashabaranov/go-openai"
110+
- follows:
111+
stopBy: end
112+
has:
113+
stopBy: end
114+
kind: import_spec
115+
regex: "github.com/sashabaranov/go-openai"
116+
any:
117+
- follows:
118+
stopBy: end
119+
kind: assignment_statement
120+
all:
121+
- has:
122+
kind: expression_list
123+
has:
124+
pattern: $VAR
125+
- has:
126+
kind: expression_list
127+
has:
128+
pattern: $SECRET
129+
- inside:
130+
stopBy: end
131+
follows:
132+
stopBy: end
133+
kind: assignment_statement
134+
all:
135+
- has:
136+
kind: expression_list
137+
has:
138+
pattern: $VAR
139+
- has:
140+
kind: expression_list
141+
has:
142+
pattern: $SECRET
143+
- follows:
144+
stopBy: end
145+
kind: const_declaration
146+
all:
147+
- has:
148+
kind: const_spec
149+
has:
150+
pattern: $VAR
151+
- has:
152+
kind: expression_list
153+
has:
154+
pattern: $SECRET
155+
- inside:
156+
stopBy: end
157+
follows:
158+
stopBy: end
159+
kind: const_declaration
160+
all:
161+
- has:
162+
kind: const_spec
163+
has:
164+
pattern: $VAR
165+
- has:
166+
kind: expression_list
167+
has:
168+
pattern: $SECRET
169+
- follows:
170+
stopBy: end
171+
kind: var_declaration
172+
has:
173+
kind: var_spec
174+
all:
175+
- has:
176+
kind: identifier
177+
pattern: $VAR
178+
- has:
179+
kind: expression_list
180+
has:
181+
pattern: $SECRET
182+
- inside:
183+
stopBy: end
184+
follows:
185+
stopBy: end
186+
kind: var_declaration
187+
has:
188+
kind: var_spec
189+
all:
190+
- has:
191+
kind: identifier
192+
pattern: $VAR
193+
- has:
194+
kind: expression_list
195+
has:
196+
pattern: $SECRET
197+
rule:
198+
kind: call_expression
199+
any:
200+
- matches: MATCH_openai.NewClient
201+
- matches: MATCH_openai.NewClient_instance
202+
not:
203+
all:
204+
- has:
205+
stopBy: end
206+
kind: ERROR
207+
- inside:
208+
stopBy: end
209+
kind: ERROR
210+
constraints:
211+
SECRET:
212+
not:
213+
regex: ^""$

‎tests/__snapshots__/openai-hardcoded-secret-go-snapshot.yml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
id: openai-hardcoded-secret-go
2+
snapshots:
3+
? |
4+
import (
5+
"github.com/sashabaranov/go-openai"
6+
)
7+
func main() {
8+
client := openai.NewClient("my-openai-token")
9+
}
10+
: labels:
11+
- source: openai.NewClient("my-openai-token")
12+
style: primary
13+
start: 75
14+
end: 110
15+
- source: openai
16+
style: secondary
17+
start: 75
18+
end: 81
19+
- source: NewClient
20+
style: secondary
21+
start: 82
22+
end: 91
23+
- source: openai.NewClient
24+
style: secondary
25+
start: 75
26+
end: 91
27+
- source: my-openai-token
28+
style: secondary
29+
start: 93
30+
end: 108
31+
- source: '"my-openai-token"'
32+
style: secondary
33+
start: 92
34+
end: 109
35+
- source: ("my-openai-token")
36+
style: secondary
37+
start: 91
38+
end: 110
39+
- source: '"github.com/sashabaranov/go-openai"'
40+
style: secondary
41+
start: 11
42+
end: 46
43+
- source: '"github.com/sashabaranov/go-openai"'
44+
style: secondary
45+
start: 11
46+
end: 46
47+
- source: '"github.com/sashabaranov/go-openai"'
48+
style: secondary
49+
start: 11
50+
end: 46

‎tests/go/openai-hardcoded-secret-go-test.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
id: openai-hardcoded-secret-go
2+
valid:
3+
- |
4+
invalid:
5+
- |
6+
import (
7+
"github.com/sashabaranov/go-openai"
8+
)
9+
func main() {
10+
client := openai.NewClient("my-openai-token")
11+
}

0 commit comments

Comments
 (0)