openai-hardcoded-secret-python

ESS-ENN · ESS-ENN · commit f732bc54bae6 · 2024-12-04T20:16:32.000+05:30
diff --git a/rules/python/security/openai-hardcoded-secret-python.yml b/rules/python/security/openai-hardcoded-secret-python.yml
@@ -0,0 +1,24 @@
+id: openai-hardcoded-secret-python
+language: python
+severity: warning
+message: >-
+      A secret is hard-coded in the application. Secrets stored in source
+      code, such as credentials, identifiers, and other types of sensitive data,
+      can be leaked and used by internal or external malicious actors. Use
+      environment variables to securely provide credentials and other secrets or
+      retrieve them from a secure vault or Hardware Security Module (HSM).
+note: >-
+  [CWE-798]: Use of Hard-coded Credentials
+  [OWASP A07:2021]: Identification and Authentication Failures
+  [REFERENCES]
+       https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+utils:
+    match_api_key:
+        kind: string_content
+        regex: \b(sk-[[:alnum:]]{20}T3BlbkFJ[[:alnum:]]{20})\b
+        inside:
+         stopBy: end
+         kind: string
+rule:
+    all:
+        - matches: match_api_key
diff --git a/tests/__snapshots__/openai-hardcoded-secret-python-snapshot.yml b/tests/__snapshots__/openai-hardcoded-secret-python-snapshot.yml
@@ -0,0 +1,14 @@
+id: openai-hardcoded-secret-python
+snapshots:
+  ? |
+    api_key="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"
+    f = "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"
+  : labels:
+    - source: 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
+      style: primary
+      start: 9
+      end: 60
+    - source: '"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"'
+      style: secondary
+      start: 8
+      end: 61
diff --git a/tests/python/openai-hardcoded-secret-python-test.yml b/tests/python/openai-hardcoded-secret-python-test.yml
@@ -0,0 +1,8 @@
+id: openai-hardcoded-secret-python
+valid:
+  - |
+    openai.api_key="sk-ExamplexT3BlbkFJp6xpvsfpkEsmAJawIm0V"
+invalid:
+  - |
+    api_key="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"
+    f = "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"
