Skip to content

Commit bed1a07

Browse files
author
Sakshis
committed
sqlconnectionstringbuilder-hardcoded-secret-csharp
1 parent e2dac8d commit bed1a07

File tree

3 files changed

+654
-0
lines changed

3 files changed

+654
-0
lines changed

‎rules/csharp/security/sqlconnectionstringbuilder-hardcoded-secret-csharp.yml

Lines changed: 305 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,305 @@
1+
id: sqlconnectionstringbuilder-hardcoded-secret-csharp
2+
language: csharp
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798]: Use of Hard-coded Credentials
12+
[OWASP A07:2021]: Identification and Authentication Failures
13+
[REFERENCES]
14+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
utils:
16+
match_assignment_expression:
17+
kind: assignment_expression
18+
all:
19+
- has:
20+
stopBy: end
21+
kind: member_access_expression
22+
all:
23+
- has:
24+
stopBy: end
25+
kind: identifier
26+
field: expression
27+
pattern: $BUILDER
28+
- has:
29+
stopBy: end
30+
kind: identifier
31+
field: name
32+
regex: "^Password$"
33+
- has:
34+
stopBy: end
35+
kind: string_literal
36+
has:
37+
stopBy: end
38+
kind: string_literal_content
39+
inside:
40+
stopBy: end
41+
kind: expression_statement
42+
follows:
43+
stopBy: end
44+
kind: local_declaration_statement
45+
all:
46+
- has:
47+
stopBy: end
48+
kind: variable_declaration
49+
has:
50+
stopBy: end
51+
kind: identifier
52+
field: type
53+
regex: "^SqlConnectionStringBuilder$"
54+
- has:
55+
stopBy: end
56+
kind: variable_declarator
57+
has:
58+
stopBy: end
59+
kind: identifier
60+
field: name
61+
pattern: $BUILDER
62+
- has:
63+
stopBy: end
64+
kind: object_creation_expression
65+
all:
66+
- has:
67+
stopBy: end
68+
kind: identifier
69+
field: type
70+
- has:
71+
stopBy: end
72+
kind: argument_list
73+
field: arguments
74+
match_assignment_with_brackets:
75+
kind: assignment_expression
76+
all:
77+
- has:
78+
stopBy: end
79+
kind: element_access_expression
80+
all:
81+
- has:
82+
stopBy: end
83+
kind: identifier
84+
field: expression
85+
pattern: $BUILDER
86+
- has:
87+
stopBy: end
88+
kind: bracketed_argument_list
89+
field: subscript
90+
- has:
91+
stopBy: end
92+
kind: argument
93+
- has:
94+
stopBy: end
95+
kind: string_literal
96+
has:
97+
stopBy: end
98+
kind: string_literal_content
99+
all:
100+
- not:
101+
precedes:
102+
stopBy: end
103+
kind: identifier
104+
- not:
105+
precedes:
106+
stopBy: end
107+
kind: element_access_expression
108+
- has:
109+
stopBy: end
110+
kind: string_literal
111+
has:
112+
stopBy: end
113+
kind: string_literal_content
114+
inside:
115+
stopBy: end
116+
kind: expression_statement
117+
follows:
118+
stopBy: end
119+
kind: local_declaration_statement
120+
all:
121+
- has:
122+
stopBy: end
123+
kind: variable_declaration
124+
has:
125+
stopBy: end
126+
kind: identifier
127+
field: type
128+
regex: "^SqlConnectionStringBuilder$"
129+
- has:
130+
stopBy: end
131+
kind: variable_declarator
132+
has:
133+
stopBy: end
134+
kind: identifier
135+
field: name
136+
pattern: $BUILDER
137+
- has:
138+
stopBy: end
139+
kind: object_creation_expression
140+
all:
141+
- has:
142+
stopBy: end
143+
kind: identifier
144+
field: type
145+
- has:
146+
stopBy: end
147+
kind: argument_list
148+
field: arguments
149+
match_assignment_with_brackets_above_instance:
150+
kind: assignment_expression
151+
all:
152+
- has:
153+
stopBy: end
154+
kind: element_access_expression
155+
all:
156+
- has:
157+
stopBy: end
158+
kind: identifier
159+
field: expression
160+
pattern: $CB
161+
- has:
162+
stopBy: end
163+
kind: bracketed_argument_list
164+
field: subscript
165+
- has:
166+
stopBy: end
167+
kind: argument
168+
- has:
169+
stopBy: end
170+
kind: string_literal
171+
has:
172+
stopBy: end
173+
kind: string_literal_content
174+
regex: "^Password$"
175+
not:
176+
precedes:
177+
stopBy: end
178+
kind: element_access_expression
179+
- has:
180+
kind: identifier
181+
pattern: $PASS
182+
inside:
183+
stopBy: end
184+
kind: expression_statement
185+
follows:
186+
stopBy: end
187+
kind: local_declaration_statement
188+
all:
189+
- has:
190+
stopBy: end
191+
kind: variable_declaration
192+
has:
193+
stopBy: end
194+
kind: implicit_type
195+
field: type
196+
- has:
197+
stopBy: end
198+
kind: variable_declarator
199+
has:
200+
stopBy: end
201+
kind: identifier
202+
field: name
203+
pattern: $CB
204+
- has:
205+
stopBy: end
206+
kind: object_creation_expression
207+
all:
208+
- has:
209+
stopBy: end
210+
kind: identifier
211+
field: type
212+
regex: "^SqlConnectionStringBuilder$"
213+
- has:
214+
stopBy: end
215+
kind: argument_list
216+
field: arguments
217+
follows:
218+
stopBy: end
219+
kind: local_declaration_statement
220+
all:
221+
- has:
222+
stopBy: end
223+
kind: variable_declaration
224+
has:
225+
stopBy: end
226+
kind: predefined_type
227+
field: type
228+
- has:
229+
stopBy: end
230+
kind: variable_declarator
231+
has:
232+
stopBy: end
233+
kind: identifier
234+
field: name
235+
pattern: $PASS
236+
- has:
237+
stopBy: end
238+
kind: string_literal
239+
has:
240+
stopBy: end
241+
kind: string_literal_content
242+
match_assignment_without_brackets_above_instance:
243+
kind: assignment_expression
244+
all:
245+
- has:
246+
stopBy: end
247+
kind: member_access_expression
248+
all:
249+
- has:
250+
stopBy: end
251+
kind: identifier
252+
field: expression
253+
pattern: $CB
254+
- has:
255+
stopBy: end
256+
kind: identifier
257+
field: name
258+
regex: "^Password$"
259+
- has:
260+
stopBy: end
261+
kind: string_literal
262+
has:
263+
stopBy: end
264+
kind: string_literal_content
265+
inside:
266+
stopBy: end
267+
kind: expression_statement
268+
follows:
269+
stopBy: end
270+
kind: local_declaration_statement
271+
all:
272+
- has:
273+
stopBy: end
274+
kind: variable_declaration
275+
has:
276+
stopBy: end
277+
kind: implicit_type
278+
field: type
279+
- has:
280+
stopBy: end
281+
kind: variable_declarator
282+
has:
283+
stopBy: end
284+
kind: identifier
285+
field: name
286+
pattern: $CB
287+
- has:
288+
stopBy: end
289+
kind: object_creation_expression
290+
all:
291+
- has:
292+
stopBy: end
293+
kind: identifier
294+
field: type
295+
regex: "^SqlConnectionStringBuilder$"
296+
- has:
297+
stopBy: end
298+
kind: argument_list
299+
field: arguments
300+
rule:
301+
any:
302+
- matches: match_assignment_expression
303+
- matches: match_assignment_with_brackets
304+
- matches: match_assignment_with_brackets_above_instance
305+
- matches: match_assignment_without_brackets_above_instance

0 commit comments

Comments
 (0)