Skip to content

Commit c125a42

Browse files
ESS-ENNESS-ENN
committed
hkdf-hardcoded-secret-swift
1 parent 3195f93 commit c125a42

File tree

3 files changed

+560
-0
lines changed

3 files changed

+560
-0
lines changed

‎rules/swift/security/hkdf-hardcoded-secret-swift.yml

Lines changed: 291 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
id: hkdf-hardcoded-secret-swift
2+
severity: warning
3+
language: swift
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
utils:
15+
match_pattern_try_expression_directly:
16+
kind: try_expression
17+
has:
18+
stopBy: end
19+
kind: call_expression
20+
all:
21+
- has:
22+
stopBy: end
23+
kind: simple_identifier
24+
regex: "^HKDF$"
25+
- has:
26+
stopBy: end
27+
kind: call_suffix
28+
has:
29+
stopBy: end
30+
kind: value_arguments
31+
has:
32+
stopBy: end
33+
kind: value_argument
34+
all:
35+
- has:
36+
stopBy: end
37+
kind: simple_identifier
38+
regex: "^password$"
39+
- has:
40+
stopBy: end
41+
kind: line_string_literal
42+
has:
43+
stopBy: end
44+
kind: line_str_text
45+
46+
match_pattern_HKDF_statement_directly:
47+
kind: call_expression
48+
all:
49+
- has:
50+
stopBy: end
51+
kind: simple_identifier
52+
regex: "^HKDF$"
53+
- has:
54+
stopBy: end
55+
kind: call_suffix
56+
has:
57+
stopBy: end
58+
kind: value_arguments
59+
has:
60+
stopBy: end
61+
kind: value_argument
62+
all:
63+
- has:
64+
stopBy: end
65+
kind: simple_identifier
66+
regex: "^password$"
67+
- has:
68+
stopBy: end
69+
kind: line_string_literal
70+
has:
71+
stopBy: end
72+
kind: line_str_text
73+
- not:
74+
inside:
75+
stopBy: neighbor
76+
kind: try_expression
77+
78+
match_pattern_HKDF_expression_with_instance:
79+
kind: call_expression
80+
all:
81+
- has:
82+
stopBy: neighbor
83+
kind: simple_identifier
84+
regex: "^HKDF$"
85+
- has:
86+
stopBy: neighbor
87+
kind: call_suffix
88+
has:
89+
stopBy: neighbor
90+
kind: value_arguments
91+
has:
92+
stopBy: neighbor
93+
kind: value_argument
94+
all:
95+
- has:
96+
stopBy: neighbor
97+
kind: simple_identifier
98+
regex: "^password$"
99+
- has:
100+
stopBy: end
101+
kind: simple_identifier
102+
nthChild: 2
103+
pattern: $R
104+
- not:
105+
inside:
106+
stopBy: neighbor
107+
kind: try_expression
108+
- inside:
109+
stopBy: end
110+
kind: property_declaration
111+
follows:
112+
stopBy: end
113+
kind: property_declaration
114+
all:
115+
- has:
116+
stopBy: end
117+
kind: pattern
118+
has:
119+
stopBy: end
120+
kind: simple_identifier
121+
pattern: $R
122+
- has:
123+
stopBy: neighbor
124+
kind: call_expression
125+
pattern: Array("$$$".utf8)
126+
127+
match_pattern_try_expression_with_instance:
128+
kind: try_expression
129+
all:
130+
- has:
131+
stopBy: neighbor
132+
kind: call_expression
133+
all:
134+
- has:
135+
stopBy: neighbor
136+
kind: simple_identifier
137+
regex: "^HKDF$"
138+
- has:
139+
stopBy: neighbor
140+
kind: call_suffix
141+
has:
142+
stopBy: neighbor
143+
kind: value_arguments
144+
has:
145+
stopBy: neighbor
146+
kind: value_argument
147+
all:
148+
- has:
149+
stopBy: neighbor
150+
kind: simple_identifier
151+
regex: "^password$"
152+
- has:
153+
stopBy: end
154+
kind: simple_identifier
155+
nthChild: 2
156+
pattern: $R
157+
- inside:
158+
stopBy: end
159+
kind: property_declaration
160+
follows:
161+
stopBy: end
162+
kind: property_declaration
163+
all:
164+
- has:
165+
stopBy: end
166+
kind: pattern
167+
has:
168+
stopBy: end
169+
kind: simple_identifier
170+
pattern: $R
171+
- has:
172+
stopBy: neighbor
173+
kind: call_expression
174+
pattern: Array("$$$".utf8)
175+
176+
match_pattern_HKDF_expression_with_utf8:
177+
kind: call_expression
178+
all:
179+
- has:
180+
stopBy: end
181+
kind: simple_identifier
182+
regex: "^HKDF$"
183+
- has:
184+
stopBy: end
185+
kind: call_suffix
186+
has:
187+
stopBy: end
188+
kind: value_argument
189+
all:
190+
- has:
191+
stopBy: end
192+
kind: simple_identifier
193+
regex: "^password$"
194+
- has:
195+
stopBy: end
196+
kind: call_expression
197+
all:
198+
- has:
199+
stopBy: end
200+
kind: simple_identifier
201+
regex: "^Array$"
202+
- has:
203+
stopBy: end
204+
kind: call_suffix
205+
has:
206+
stopBy: end
207+
kind: value_argument
208+
has:
209+
stopBy: end
210+
kind: navigation_expression
211+
all:
212+
- has:
213+
stopBy: end
214+
kind: line_string_literal
215+
has:
216+
stopBy: end
217+
kind: line_str_text
218+
- has:
219+
stopBy: end
220+
kind: navigation_suffix
221+
has:
222+
stopBy: end
223+
kind: simple_identifier
224+
regex: "^utf8$"
225+
226+
match_pattern_try_expression_with_utf8:
227+
kind: try_expression
228+
has:
229+
stopBy: neighbor
230+
kind: call_expression
231+
all:
232+
- has:
233+
stopBy: neighbor
234+
kind: simple_identifier
235+
regex: "^HKDF$"
236+
- has:
237+
stopBy: neighbor
238+
kind: call_suffix
239+
has:
240+
stopBy: end
241+
kind: value_argument
242+
all:
243+
- has:
244+
stopBy: neighbor
245+
kind: simple_identifier
246+
regex: "^password$"
247+
- has:
248+
stopBy: neighbor
249+
kind: call_expression
250+
all:
251+
- has:
252+
stopBy: neighbor
253+
kind: simple_identifier
254+
regex: "^Array$"
255+
- has:
256+
stopBy: neighbor
257+
kind: call_suffix
258+
has:
259+
stopBy: end
260+
kind: value_argument
261+
has:
262+
stopBy: neighbor
263+
kind: navigation_expression
264+
all:
265+
- has:
266+
stopBy: neighbor
267+
kind: line_string_literal
268+
has:
269+
stopBy: neighbor
270+
kind: line_str_text
271+
- has:
272+
stopBy: neighbor
273+
kind: navigation_suffix
274+
has:
275+
stopBy: neighbor
276+
kind: simple_identifier
277+
regex: "^utf8$"
278+
279+
rule:
280+
any:
281+
- kind: try_expression
282+
any:
283+
- matches: match_pattern_try_expression_directly
284+
- matches: match_pattern_try_expression_with_instance
285+
- matches: match_pattern_try_expression_with_utf8
286+
287+
- kind: call_expression
288+
any:
289+
- matches: match_pattern_HKDF_statement_directly
290+
- matches: match_pattern_HKDF_expression_with_instance
291+
- matches: match_pattern_HKDF_expression_with_utf8

0 commit comments

Comments
 (0)