hardcoded-http-auth-in-controller-ruby

ESS-ENN · ESS-ENN · commit d7f07f429e2e · 2024-12-18T16:55:40.000+05:30
diff --git a/rules/ruby/security/hardcoded-http-auth-in-controller-ruby.yml b/rules/ruby/security/hardcoded-http-auth-in-controller-ruby.yml
@@ -10,50 +10,50 @@ note: >-
   [CWE-798] Use of Hard-coded Credentials.
   [REFERENCES]
       - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+
 utils:
   MATCH_PASSWORD_STRING:
-   kind: string
-   inside:
-     stopBy: end
-     kind: pair
-     all:
-      - has:
-          stopBy: neighbor
-          kind: simple_symbol
-          regex: '^:password$'
-      - has:
-          stopBy: neighbor
-          kind: string
-      - inside:
-          stopBy: neighbor
-          kind: argument_list
-          inside:
+    kind: string
+    inside:
+      stopBy: end
+      kind: pair
+      all:
+        - has:
+            stopBy: neighbor
+            kind: simple_symbol
+            regex: "^:password$"
+        - has:
+            stopBy: neighbor
+            kind: string
+            has:
+              stopBy: neighbor
+              kind: string_content
+        - inside:
+            stopBy: neighbor
+            kind: argument_list
+            inside:
+              stopBy: end
+              kind: call
+              all:
+                - has:
+                    stopBy: neighbor
+                    kind: identifier
+                    regex: "^http_basic_authenticate_with$"
+        - inside:
             stopBy: end
-            kind: call
+            kind: class
             all:
               - has:
                   stopBy: neighbor
-                  kind: identifier
-                  regex: '^http_basic_authenticate_with$'
-              - inside:
-                  stopBy: neighbor
-                  kind: body_statement
-                  inside:
-                    stopBy: end
-                    kind: class
-                    all:
-                      - has:
-                          stopBy: neighbor
-                          kind: constant
-                      - has:
-                          stopBy: end
-                          kind: superclass
-                          has:
-                            stopBy: neighbor
-                            kind: constant
-                            regex: '^ApplicationController$'
+                  kind: constant
+              - has:
+                  stopBy: end
+                  kind: superclass
+                  has:
+                    stopBy: neighbor
+                    kind: constant
+                    regex: "^ApplicationController$"
 
 rule:
   kind: string
   matches: MATCH_PASSWORD_STRING
-
diff --git a/tests/__snapshots__/hardcoded-http-auth-in-controller-ruby-snapshot.yml b/tests/__snapshots__/hardcoded-http-auth-in-controller-ruby-snapshot.yml
@@ -14,6 +14,10 @@ snapshots:
       style: secondary
       start: 95
       end: 104
+    - source: secret
+      style: secondary
+      start: 109
+      end: 115
     - source: '"secret"'
       style: secondary
       start: 108
@@ -22,6 +26,14 @@ snapshots:
       style: secondary
       start: 50
       end: 78
+    - source: http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index
+      style: secondary
+      start: 50
+      end: 135
+    - source: :name => "dhh", :password => "secret", :except => :index
+      style: secondary
+      start: 79
+      end: 135
     - source: DangerousController
       style: secondary
       start: 6
@@ -42,20 +54,6 @@ snapshots:
       style: secondary
       start: 0
       end: 160
-    - source: |-
-        http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index
-        puts "do more stuff"
-      style: secondary
-      start: 50
-      end: 156
-    - source: http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index
-      style: secondary
-      start: 50
-      end: 135
-    - source: :name => "dhh", :password => "secret", :except => :index
-      style: secondary
-      start: 79
-      end: 135
     - source: :password => "secret"
       style: secondary
       start: 95
