Skip to content

Commit f1883e7

Browse files
ESS-ENNESS-ENN
committed
python-couchbase-empty-password-python
1 parent e108346 commit f1883e7

File tree

3 files changed

+218
-0
lines changed

3 files changed

+218
-0
lines changed

‎rules/python/security/python-couchbase-empty-password-python.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
id: python-couchbase-empty-password-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
The application creates a database connection with an empty password.
6+
This can lead to unauthorized access by either an internal or external
7+
malicious actor. To prevent this vulnerability, enforce authentication
8+
when connecting to a database by using environment variables to securely
9+
provide credentials or retrieving them from a secure vault or HSM
10+
(Hardware Security Module).
11+
note: >-
12+
[CWE-287]: Improper Authentication
13+
[OWASP A07:2021]: Identification and Authentication Failures
14+
[REFERENCES]
15+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
16+
utils:
17+
match_passwordauthenticator:
18+
kind: call
19+
all:
20+
- has:
21+
kind: identifier
22+
pattern: $R
23+
- has:
24+
stopBy: neighbor
25+
kind: argument_list
26+
all:
27+
- any:
28+
- has:
29+
stopBy: end
30+
kind: attribute
31+
has:
32+
stopBy: neighbor
33+
kind: identifier
34+
- has:
35+
stopBy: neighbor
36+
kind: string
37+
- has:
38+
stopBy: neighbor
39+
kind: string
40+
not:
41+
has:
42+
stopBy: neighbor
43+
kind: string_content
44+
45+
- inside:
46+
stopBy: end
47+
kind: module
48+
has:
49+
stopBy: end
50+
kind: import_from_statement
51+
all:
52+
- has:
53+
stopBy: end
54+
kind: dotted_name
55+
field: module_name
56+
all:
57+
- has:
58+
stopBy: end
59+
kind: identifier
60+
regex: couchbase_core
61+
- has:
62+
stopBy: end
63+
kind: identifier
64+
regex: cluster
65+
- has:
66+
stopBy: end
67+
kind: dotted_name
68+
field: name
69+
has:
70+
stopBy: end
71+
kind: identifier
72+
pattern: $R
73+
regex: PasswordAuthenticator
74+
rule:
75+
all:
76+
- matches: match_passwordauthenticator
77+

‎tests/__snapshots__/python-couchbase-empty-password-python-snapshot.yml

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
id: python-couchbase-empty-password-python
2+
snapshots:
3+
? |
4+
import os
5+
from couchbase.cluster import Cluster, ClusterOptions
6+
from couchbase_core.cluster import PasswordAuthenticator
7+
PasswordAuthenticator('username', '')
8+
: labels:
9+
- source: PasswordAuthenticator('username', '')
10+
style: primary
11+
start: 121
12+
end: 158
13+
- source: PasswordAuthenticator
14+
style: secondary
15+
start: 121
16+
end: 142
17+
- source: '''username'''
18+
style: secondary
19+
start: 143
20+
end: 153
21+
- source: ''''''
22+
style: secondary
23+
start: 155
24+
end: 157
25+
- source: ('username', '')
26+
style: secondary
27+
start: 142
28+
end: 158
29+
- source: couchbase_core
30+
style: secondary
31+
start: 69
32+
end: 83
33+
- source: cluster
34+
style: secondary
35+
start: 84
36+
end: 91
37+
- source: couchbase_core.cluster
38+
style: secondary
39+
start: 69
40+
end: 91
41+
- source: PasswordAuthenticator
42+
style: secondary
43+
start: 99
44+
end: 120
45+
- source: PasswordAuthenticator
46+
style: secondary
47+
start: 99
48+
end: 120
49+
- source: from couchbase_core.cluster import PasswordAuthenticator
50+
style: secondary
51+
start: 64
52+
end: 120
53+
- source: |
54+
import os
55+
from couchbase.cluster import Cluster, ClusterOptions
56+
from couchbase_core.cluster import PasswordAuthenticator
57+
PasswordAuthenticator('username', '')
58+
style: secondary
59+
start: 0
60+
end: 159
61+
? |
62+
import os
63+
from couchbase.cluster import Cluster, ClusterOptions
64+
from couchbase_core.cluster import PasswordAuthenticator
65+
cluster = Cluster('couchbase://localhost', ClusterOptions(PasswordAuthenticator('username', '')))
66+
: labels:
67+
- source: PasswordAuthenticator('username', '')
68+
style: primary
69+
start: 179
70+
end: 216
71+
- source: PasswordAuthenticator
72+
style: secondary
73+
start: 179
74+
end: 200
75+
- source: '''username'''
76+
style: secondary
77+
start: 201
78+
end: 211
79+
- source: ''''''
80+
style: secondary
81+
start: 213
82+
end: 215
83+
- source: ('username', '')
84+
style: secondary
85+
start: 200
86+
end: 216
87+
- source: couchbase_core
88+
style: secondary
89+
start: 69
90+
end: 83
91+
- source: cluster
92+
style: secondary
93+
start: 84
94+
end: 91
95+
- source: couchbase_core.cluster
96+
style: secondary
97+
start: 69
98+
end: 91
99+
- source: PasswordAuthenticator
100+
style: secondary
101+
start: 99
102+
end: 120
103+
- source: PasswordAuthenticator
104+
style: secondary
105+
start: 99
106+
end: 120
107+
- source: from couchbase_core.cluster import PasswordAuthenticator
108+
style: secondary
109+
start: 64
110+
end: 120
111+
- source: |
112+
import os
113+
from couchbase.cluster import Cluster, ClusterOptions
114+
from couchbase_core.cluster import PasswordAuthenticator
115+
cluster = Cluster('couchbase://localhost', ClusterOptions(PasswordAuthenticator('username', '')))
116+
style: secondary
117+
start: 0
118+
end: 219

‎tests/python/python-couchbase-empty-password-python-test.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: python-couchbase-empty-password-python
2+
valid:
3+
- |
4+
import os
5+
from couchbase.cluster import Cluster, ClusterOptions
6+
from couchbase_core.cluster import PasswordAuthenticator
7+
PasswordAuthenticator('username', os.env['pass'])
8+
- |
9+
import os
10+
from couchbase.cluster import Cluster, ClusterOptions
11+
from couchbase_core.cluster import PasswordAuthenticator
12+
PasswordAuthenticator('username', os.getenv(''))
13+
invalid:
14+
- |
15+
import os
16+
from couchbase.cluster import Cluster, ClusterOptions
17+
from couchbase_core.cluster import PasswordAuthenticator
18+
cluster = Cluster('couchbase://localhost', ClusterOptions(PasswordAuthenticator('username', '')))
19+
- |
20+
import os
21+
from couchbase.cluster import Cluster, ClusterOptions
22+
from couchbase_core.cluster import PasswordAuthenticator
23+
PasswordAuthenticator('username', '')

0 commit comments

Comments
 (0)