Skip to content

Commit e3d6bae

Browse files
author
Sakshis
committed
system-setproperty-hardcoded-secret-java
1 parent c333c16 commit e3d6bae

File tree

3 files changed

+401
-0
lines changed

3 files changed

+401
-0
lines changed

‎rules/java/security/system-setproperty-hardcoded-secret-java.yml

Lines changed: 321 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,321 @@
1+
id: system-setproperty-hardcoded-secret-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
15+
ast-grep-essentials: true
16+
utils:
17+
match_string_literal:
18+
kind: string_fragment
19+
inside:
20+
kind: string_literal
21+
all:
22+
- nthChild:
23+
position: 2
24+
ofRule:
25+
not:
26+
kind: line_comment
27+
- inside:
28+
kind: argument_list
29+
all:
30+
- not:
31+
has:
32+
nthChild:
33+
position: 3
34+
ofRule:
35+
not:
36+
kind: line_comment
37+
- has:
38+
kind: string_literal
39+
has:
40+
kind: string_fragment
41+
regex: ^javax.net.ssl.keyStorePassword|javax.net.ssl.trustStorePassword$
42+
nthChild:
43+
position: 1
44+
ofRule:
45+
not:
46+
kind: line_comment
47+
- inside:
48+
kind: method_invocation
49+
all:
50+
- has:
51+
kind: identifier
52+
nthChild: 1
53+
regex: ^System$
54+
- has:
55+
kind: identifier
56+
nthChild: 2
57+
regex: ^setProperty$
58+
59+
match_string_literal_instance:
60+
kind: identifier
61+
pattern: $PASSWORD
62+
all:
63+
- nthChild:
64+
position: 2
65+
ofRule:
66+
not:
67+
kind: line_comment
68+
- inside:
69+
kind: argument_list
70+
all:
71+
- not:
72+
has:
73+
nthChild:
74+
position: 3
75+
ofRule:
76+
not:
77+
kind: line_comment
78+
- has:
79+
kind: string_literal
80+
has:
81+
kind: string_fragment
82+
regex: ^javax.net.ssl.keyStorePassword|javax.net.ssl.trustStorePassword$
83+
nthChild:
84+
position: 1
85+
ofRule:
86+
not:
87+
kind: line_comment
88+
- inside:
89+
kind: method_invocation
90+
all:
91+
- has:
92+
kind: identifier
93+
nthChild: 1
94+
regex: ^System$
95+
- has:
96+
kind: identifier
97+
nthChild: 2
98+
regex: ^setProperty$
99+
- any:
100+
- inside:
101+
stopBy: end
102+
follows:
103+
stopBy: end
104+
kind: local_variable_declaration
105+
has:
106+
kind: variable_declarator
107+
all:
108+
- has:
109+
kind: identifier
110+
pattern: $PASSWORD
111+
nthChild: 1
112+
- has:
113+
kind: string_literal
114+
nthChild: 2
115+
has:
116+
kind: string_fragment
117+
- follows:
118+
stopBy: end
119+
kind: local_variable_declaration
120+
has:
121+
kind: variable_declarator
122+
all:
123+
- has:
124+
kind: identifier
125+
pattern: $PASSWORD
126+
nthChild: 1
127+
- has:
128+
kind: string_literal
129+
nthChild: 2
130+
has:
131+
kind: string_fragment
132+
133+
134+
match_string_literal_with_link_instance:
135+
kind: string_fragment
136+
inside:
137+
kind: string_literal
138+
all:
139+
- nthChild:
140+
position: 2
141+
ofRule:
142+
not:
143+
kind: line_comment
144+
- inside:
145+
kind: argument_list
146+
all:
147+
- not:
148+
has:
149+
nthChild:
150+
position: 3
151+
ofRule:
152+
not:
153+
kind: line_comment
154+
- has:
155+
kind: identifier
156+
pattern: $LINK
157+
nthChild:
158+
position: 1
159+
ofRule:
160+
not:
161+
kind: line_comment
162+
- inside:
163+
kind: method_invocation
164+
all:
165+
- has:
166+
kind: identifier
167+
nthChild: 1
168+
regex: ^System$
169+
- has:
170+
kind: identifier
171+
nthChild: 2
172+
regex: ^setProperty$
173+
- any:
174+
- inside:
175+
stopBy: end
176+
follows:
177+
stopBy: end
178+
kind: local_variable_declaration
179+
has:
180+
kind: variable_declarator
181+
all:
182+
- has:
183+
kind: identifier
184+
pattern: $LINK
185+
nthChild: 1
186+
- has:
187+
kind: string_literal
188+
nthChild: 2
189+
has:
190+
kind: string_fragment
191+
regex: ^javax.net.ssl.keyStorePassword|javax.net.ssl.trustStorePassword$
192+
- follows:
193+
stopBy: end
194+
kind: local_variable_declaration
195+
has:
196+
kind: variable_declarator
197+
all:
198+
- has:
199+
kind: identifier
200+
pattern: $LINK
201+
nthChild: 1
202+
- has:
203+
kind: string_literal
204+
nthChild: 2
205+
has:
206+
kind: string_fragment
207+
regex: ^javax.net.ssl.keyStorePassword|javax.net.ssl.trustStorePassword$
208+
209+
match_pattern_with_both-links:
210+
kind: identifier
211+
pattern: $PASSWORD
212+
all:
213+
- nthChild:
214+
position: 2
215+
ofRule:
216+
not:
217+
kind: line_comment
218+
- inside:
219+
kind: argument_list
220+
all:
221+
- not:
222+
has:
223+
nthChild:
224+
position: 3
225+
ofRule:
226+
not:
227+
kind: line_comment
228+
- has:
229+
kind: identifier
230+
pattern: $LINK
231+
nthChild:
232+
position: 1
233+
ofRule:
234+
not:
235+
kind: line_comment
236+
- inside:
237+
kind: method_invocation
238+
all:
239+
- has:
240+
kind: identifier
241+
nthChild: 1
242+
regex: ^System$
243+
- has:
244+
kind: identifier
245+
nthChild: 2
246+
regex: ^setProperty$
247+
- any:
248+
- inside:
249+
stopBy: end
250+
follows:
251+
stopBy: end
252+
kind: local_variable_declaration
253+
has:
254+
kind: variable_declarator
255+
all:
256+
- has:
257+
kind: identifier
258+
pattern: $LINK
259+
nthChild: 1
260+
- has:
261+
kind: string_literal
262+
nthChild: 2
263+
has:
264+
kind: string_fragment
265+
regex: ^javax.net.ssl.keyStorePassword|javax.net.ssl.trustStorePassword$
266+
- follows:
267+
stopBy: end
268+
kind: local_variable_declaration
269+
has:
270+
kind: variable_declarator
271+
all:
272+
- has:
273+
kind: identifier
274+
pattern: $LINK
275+
nthChild: 1
276+
- has:
277+
kind: string_literal
278+
nthChild: 2
279+
has:
280+
kind: string_fragment
281+
regex: ^javax.net.ssl.keyStorePassword|javax.net.ssl.trustStorePassword$
282+
- any:
283+
- inside:
284+
stopBy: end
285+
follows:
286+
stopBy: end
287+
kind: local_variable_declaration
288+
has:
289+
kind: variable_declarator
290+
all:
291+
- has:
292+
kind: identifier
293+
pattern: $PASSWORD
294+
nthChild: 1
295+
- has:
296+
kind: string_literal
297+
nthChild: 2
298+
has:
299+
kind: string_fragment
300+
- follows:
301+
stopBy: end
302+
kind: local_variable_declaration
303+
has:
304+
kind: variable_declarator
305+
all:
306+
- has:
307+
kind: identifier
308+
pattern: $PASSWORD
309+
nthChild: 1
310+
- has:
311+
kind: string_literal
312+
nthChild: 2
313+
has:
314+
kind: string_fragment
315+
316+
rule:
317+
any:
318+
- matches: match_string_literal
319+
- matches: match_string_literal_instance
320+
- matches: match_string_literal_with_link_instance
321+
- matches: match_pattern_with_both-links

‎tests/__snapshots__/system-setproperty-hardcoded-secret-java-snapshot.yml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
id: system-setproperty-hardcoded-secret-java
2+
snapshots:
3+
? |
4+
System.setProperty("javax.net.ssl.keyStorePassword", "password");
5+
: labels:
6+
- source: password
7+
style: primary
8+
start: 54
9+
end: 62
10+
- source: javax.net.ssl.keyStorePassword
11+
style: secondary
12+
start: 20
13+
end: 50
14+
- source: '"javax.net.ssl.keyStorePassword"'
15+
style: secondary
16+
start: 19
17+
end: 51
18+
- source: System
19+
style: secondary
20+
start: 0
21+
end: 6
22+
- source: setProperty
23+
style: secondary
24+
start: 7
25+
end: 18
26+
- source: System.setProperty("javax.net.ssl.keyStorePassword", "password")
27+
style: secondary
28+
start: 0
29+
end: 64
30+
- source: ("javax.net.ssl.keyStorePassword", "password")
31+
style: secondary
32+
start: 18
33+
end: 64
34+
- source: '"password"'
35+
style: secondary
36+
start: 53
37+
end: 63
38+
System.setProperty("javax.net.ssl.trustStorePassword", "password");:
39+
labels:
40+
- source: password
41+
style: primary
42+
start: 56
43+
end: 64
44+
- source: javax.net.ssl.trustStorePassword
45+
style: secondary
46+
start: 20
47+
end: 52
48+
- source: '"javax.net.ssl.trustStorePassword"'
49+
style: secondary
50+
start: 19
51+
end: 53
52+
- source: System
53+
style: secondary
54+
start: 0
55+
end: 6
56+
- source: setProperty
57+
style: secondary
58+
start: 7
59+
end: 18
60+
- source: System.setProperty("javax.net.ssl.trustStorePassword", "password")
61+
style: secondary
62+
start: 0
63+
end: 66
64+
- source: ("javax.net.ssl.trustStorePassword", "password")
65+
style: secondary
66+
start: 18
67+
end: 66
68+
- source: '"password"'
69+
style: secondary
70+
start: 55
71+
end: 65

0 commit comments

Comments
 (0)