Skip to content

Commit d7e7531

Browse files
author
Sakshis
committed
python-psycopg2-empty-password-python
1 parent d063dbb commit d7e7531

File tree

3 files changed

+176
-0
lines changed

3 files changed

+176
-0
lines changed

‎rules/python/security/python-psycopg2-empty-password-python.yml

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
id: python-psycopg2-empty-password-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
The application creates a database connection with an empty password.
6+
This can lead to unauthorized access by either an internal or external
7+
malicious actor. To prevent this vulnerability, enforce authentication
8+
when connecting to a database by using environment variables to securely
9+
provide credentials or retrieving them from a secure vault or HSM
10+
(Hardware Security Module).
11+
note: >-
12+
[CWE-287] Improper Authentication.
13+
[REFERENCES]
14+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
utils:
16+
psycopg2.connect(..., password="",...):
17+
kind: call
18+
all:
19+
- has:
20+
stopBy: neighbor
21+
kind: attribute
22+
regex: ^psycopg2.connect$
23+
- has:
24+
stopBy: neighbor
25+
kind: argument_list
26+
has:
27+
stopBy: end
28+
kind: keyword_argument
29+
all:
30+
- has:
31+
stopBy: neighbor
32+
kind: identifier
33+
regex: ^password$
34+
- has:
35+
stopBy: neighbor
36+
kind: string
37+
not:
38+
has:
39+
stopBy: neighbor
40+
kind: string_content
41+
psycopg2.connect(..., password=$VAR,...)_with_instance:
42+
kind: call
43+
all:
44+
- has:
45+
stopBy: neighbor
46+
kind: attribute
47+
regex: ^psycopg2.connect$
48+
- has:
49+
stopBy: neighbor
50+
kind: argument_list
51+
has:
52+
stopBy: end
53+
kind: keyword_argument
54+
all:
55+
- has:
56+
stopBy: neighbor
57+
kind: identifier
58+
regex: ^password$
59+
- has:
60+
stopBy: neighbor
61+
kind: identifier
62+
pattern: $PSWD
63+
nthChild: 2
64+
- inside:
65+
stopBy: end
66+
kind: expression_statement
67+
follows:
68+
stopBy: end
69+
kind: expression_statement
70+
has:
71+
stopBy: neighbor
72+
kind: assignment
73+
all:
74+
- has:
75+
stopBy: neighbor
76+
kind: identifier
77+
pattern: $PSWD
78+
- has:
79+
stopBy: neighbor
80+
kind: string
81+
not:
82+
has:
83+
stopBy: neighbor
84+
kind: string_content
85+
rule:
86+
kind: call
87+
any:
88+
- matches: psycopg2.connect(..., password="",...)
89+
- matches: psycopg2.connect(..., password=$VAR,...)_with_instance

‎tests/__snapshots__/python-psycopg2-empty-password-python-snapshot.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
id: python-psycopg2-empty-password-python
2+
snapshots:
3+
? |
4+
PASSWORD = ""
5+
psycopg2.connect(password=PASSWORD)
6+
: labels:
7+
- source: psycopg2.connect(password=PASSWORD)
8+
style: primary
9+
start: 14
10+
end: 49
11+
- source: psycopg2.connect
12+
style: secondary
13+
start: 14
14+
end: 30
15+
- source: password
16+
style: secondary
17+
start: 31
18+
end: 39
19+
- source: PASSWORD
20+
style: secondary
21+
start: 40
22+
end: 48
23+
- source: password=PASSWORD
24+
style: secondary
25+
start: 31
26+
end: 48
27+
- source: (password=PASSWORD)
28+
style: secondary
29+
start: 30
30+
end: 49
31+
- source: PASSWORD
32+
style: secondary
33+
start: 0
34+
end: 8
35+
- source: '""'
36+
style: secondary
37+
start: 11
38+
end: 13
39+
- source: PASSWORD = ""
40+
style: secondary
41+
start: 0
42+
end: 13
43+
- source: PASSWORD = ""
44+
style: secondary
45+
start: 0
46+
end: 13
47+
- source: psycopg2.connect(password=PASSWORD)
48+
style: secondary
49+
start: 14
50+
end: 49
51+
? |
52+
psycopg2.connect(password="")
53+
: labels:
54+
- source: psycopg2.connect(password="")
55+
style: primary
56+
start: 0
57+
end: 29
58+
- source: psycopg2.connect
59+
style: secondary
60+
start: 0
61+
end: 16
62+
- source: password
63+
style: secondary
64+
start: 17
65+
end: 25
66+
- source: '""'
67+
style: secondary
68+
start: 26
69+
end: 28
70+
- source: password=""
71+
style: secondary
72+
start: 17
73+
end: 28
74+
- source: (password="")
75+
style: secondary
76+
start: 16
77+
end: 29

‎tests/python/python-psycopg2-empty-password-python-test.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
id: python-psycopg2-empty-password-python
2+
valid:
3+
- |
4+
psycopg2.connect(password="password")
5+
invalid:
6+
- |
7+
psycopg2.connect(password="")
8+
- |
9+
PASSWORD = ""
10+
psycopg2.connect(password=PASSWORD)

0 commit comments

Comments
 (0)