python-peewee-mysql-hardcoded-secret-python

ESS-ENN · ESS-ENN · commit f9fba71777b2 · 2025-01-28T18:06:22.000+05:30
diff --git a/rules/python/security/python-peewee-mysql-hardcoded-secret-python.yml b/rules/python/security/python-peewee-mysql-hardcoded-secret-python.yml
@@ -0,0 +1,54 @@
+id: python-peewee-mysql-hardcoded-secret-python
+severity: warning
+language: python
+message: >-
+      A secret is hard-coded in the application. Secrets stored in source
+      code, such as credentials, identifiers, and other types of sensitive data,
+      can be leaked and used by internal or external malicious actors. Use
+      environment variables to securely provide credentials and other secrets or
+      retrieve them from a secure vault or Hardware Security Module (HSM).
+note: >-
+  [CWE-798] Use of Hard-coded Credentials.
+  [REFERENCES]
+      - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+
+ast-grep-essentials: true
+
+utils:
+  $DB(..., password="...",...):
+    # $DB(..., password="...",...)
+    kind: call
+    all:
+    - has:
+        stopBy: neighbor
+        pattern: $DB
+        regex: ^MySQLDatabase$|^peewee.MySQLDatabase$|^MySQLConnectorDatabase$|^playhouse.mysql_ext.MySQLConnectorDatabase$|^MariaDBConnectorDatabase$|^playhouse.mysql_ext.MariaDBConnectorDatabase$|^PooledMySQLDatabase$|^playhouse.pool.PooledMySQLDatabase$
+    - has:
+        stopBy: neighbor
+        kind: argument_list
+        has:
+          stopBy: neighbor
+          kind: keyword_argument
+          all:
+            - has:
+                stopBy: neighbor
+                kind: identifier
+                regex: ^password$|^passwd$
+            - has:
+                stopBy: neighbor
+                kind: string
+                has:
+                   stopBy: neighbor
+                   kind: string_content
+rule:
+  kind: call
+  matches: $DB(..., password="...",...)
+  not:
+    all:
+      - has:
+          stopBy: end
+          kind: ERROR
+      - inside:
+          stopBy: end
+          kind: ERROR
+
diff --git a/tests/__snapshots__/python-peewee-mysql-hardcoded-secret-python-snapshot.yml b/tests/__snapshots__/python-peewee-mysql-hardcoded-secret-python-snapshot.yml
@@ -0,0 +1,32 @@
+id: python-peewee-mysql-hardcoded-secret-python
+snapshots:
+  'mysql_db1 = MySQLDatabase(''my_app'', user=''app'', password=''db_password'', host=''10.1.0.8'', port=3306) ':
+    labels:
+    - source: MySQLDatabase('my_app', user='app', password='db_password', host='10.1.0.8', port=3306)
+      style: primary
+      start: 12
+      end: 99
+    - source: MySQLDatabase
+      style: secondary
+      start: 12
+      end: 25
+    - source: password
+      style: secondary
+      start: 48
+      end: 56
+    - source: db_password
+      style: secondary
+      start: 58
+      end: 69
+    - source: '''db_password'''
+      style: secondary
+      start: 57
+      end: 70
+    - source: password='db_password'
+      style: secondary
+      start: 48
+      end: 70
+    - source: ('my_app', user='app', password='db_password', host='10.1.0.8', port=3306)
+      style: secondary
+      start: 25
+      end: 99
diff --git a/tests/python/python-peewee-mysql-hardcoded-secret-python-test.yml b/tests/python/python-peewee-mysql-hardcoded-secret-python-test.yml
@@ -0,0 +1,7 @@
+id: python-peewee-mysql-hardcoded-secret-python
+valid:
+  - |
+    mysql_db1 = MySQLDatabe('my_app', user='app', password=os.env['password'], host='10.1.0.8', port=3306)
+invalid:
+  - |
+    mysql_db1 = MySQLDatabase('my_app', user='app', password='db_password', host='10.1.0.8', port=3306) 
