Skip to content

Commit fc2171a

Browse files
ESS-ENNESS-ENN
committed
aes-hardcoded-secret-swift
1 parent c09abdf commit fc2171a

File tree

3 files changed

+388
-0
lines changed

3 files changed

+388
-0
lines changed

‎rules/swift/security/aes-hardcoded-secret-swift.yml

Lines changed: 285 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,285 @@
1+
id: aes-hardcoded-secret-swift
2+
language: swift
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[OWASP A07:2021]:Identification and Authentication Failures
12+
[CWE-272]: Least Privilege Violation
13+
[REFERENCES]
14+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
utils:
16+
match_pattern_try_expression_directly:
17+
kind: try_expression
18+
has:
19+
stopBy: neighbor
20+
kind: call_expression
21+
all:
22+
- has:
23+
stopBy: end
24+
kind: simple_identifier
25+
regex: "^AES$"
26+
- has:
27+
stopBy: end
28+
kind: call_suffix
29+
has:
30+
stopBy: end
31+
kind: value_arguments
32+
has:
33+
stopBy: end
34+
kind: value_argument
35+
all:
36+
- has:
37+
stopBy: end
38+
kind: simple_identifier
39+
regex: "^key$"
40+
- has:
41+
stopBy: neighbor
42+
kind: line_string_literal
43+
has:
44+
stopBy: end
45+
kind: line_str_text
46+
47+
match_pattern_AES_statement_directly:
48+
kind: call_expression
49+
all:
50+
- has:
51+
stopBy: end
52+
kind: simple_identifier
53+
regex: "^AES$"
54+
- has:
55+
stopBy: end
56+
kind: call_suffix
57+
has:
58+
stopBy: end
59+
kind: value_arguments
60+
has:
61+
stopBy: end
62+
kind: value_argument
63+
all:
64+
- has:
65+
stopBy: end
66+
kind: simple_identifier
67+
regex: "^key$"
68+
- has:
69+
stopBy: end
70+
kind: line_string_literal
71+
has:
72+
stopBy: neighbor
73+
kind: line_str_text
74+
- not:
75+
inside:
76+
stopBy: end
77+
kind: try_expression
78+
79+
match_pattern_AES_expression_with_instance:
80+
kind: call_expression
81+
all:
82+
- has:
83+
stopBy: end
84+
kind: simple_identifier
85+
regex: "^AES$"
86+
- has:
87+
stopBy: end
88+
kind: call_suffix
89+
has:
90+
stopBy: end
91+
kind: value_arguments
92+
has:
93+
stopBy: end
94+
kind: value_argument
95+
all:
96+
- has:
97+
stopBy: end
98+
kind: simple_identifier
99+
regex: "^key$"
100+
- has:
101+
stopBy: end
102+
kind: simple_identifier
103+
nthChild: 2
104+
pattern: $R
105+
- not:
106+
inside:
107+
stopBy: neighbor
108+
kind: try_expression
109+
- follows:
110+
stopBy: end
111+
kind: property_declaration
112+
all:
113+
- has:
114+
stopBy: end
115+
kind: pattern
116+
has:
117+
stopBy: end
118+
kind: simple_identifier
119+
pattern: $R
120+
- has:
121+
stopBy: neighbor
122+
kind: call_expression
123+
pattern: Array("$$$".utf8)
124+
125+
match_pattern_try_expression_with_instance:
126+
kind: try_expression
127+
all:
128+
- has:
129+
stopBy: neighbor
130+
kind: call_expression
131+
all:
132+
- has:
133+
stopBy: end
134+
kind: simple_identifier
135+
regex: "^AES$"
136+
- has:
137+
stopBy: end
138+
kind: call_suffix
139+
has:
140+
stopBy: end
141+
kind: value_arguments
142+
has:
143+
stopBy: end
144+
kind: value_argument
145+
all:
146+
- has:
147+
stopBy: end
148+
kind: simple_identifier
149+
regex: "^key$"
150+
- has:
151+
stopBy: end
152+
kind: simple_identifier
153+
nthChild: 2
154+
pattern: $R
155+
- follows:
156+
stopBy: end
157+
kind: property_declaration
158+
all:
159+
- has:
160+
stopBy: end
161+
kind: pattern
162+
has:
163+
stopBy: end
164+
kind: simple_identifier
165+
pattern: $R
166+
- has:
167+
stopBy: neighbor
168+
kind: call_expression
169+
pattern: Array("$$$".utf8)
170+
171+
match_pattern_AES_expression_with_utf8:
172+
kind: call_expression
173+
all:
174+
- has:
175+
stopBy: neighbor
176+
kind: simple_identifier
177+
regex: "^AES$"
178+
- has:
179+
stopBy: neighbor
180+
kind: call_suffix
181+
has:
182+
stopBy: end
183+
kind: value_argument
184+
all:
185+
- has:
186+
stopBy: end
187+
kind: simple_identifier
188+
regex: "^key$"
189+
- has:
190+
stopBy: end
191+
kind: call_expression
192+
all:
193+
- has:
194+
stopBy: neighbor
195+
kind: simple_identifier
196+
regex: "^Array$"
197+
- has:
198+
stopBy: neighbor
199+
kind: call_suffix
200+
has:
201+
stopBy: end
202+
kind: value_argument
203+
has:
204+
stopBy: neighbor
205+
kind: navigation_expression
206+
all:
207+
- has:
208+
stopBy: neighbor
209+
kind: line_string_literal
210+
has:
211+
stopBy: neighbor
212+
kind: line_str_text
213+
- has:
214+
stopBy: neighbor
215+
kind: navigation_suffix
216+
has:
217+
stopBy: neighbor
218+
kind: simple_identifier
219+
regex: "^utf8$"
220+
221+
match_pattern_try_expression_with_utf8:
222+
kind: try_expression
223+
has:
224+
stopBy: neighbor
225+
kind: call_expression
226+
all:
227+
- has:
228+
stopBy: neighbor
229+
kind: simple_identifier
230+
regex: "^AES$"
231+
- has:
232+
stopBy: neighbor
233+
kind: call_suffix
234+
has:
235+
stopBy: end
236+
kind: value_argument
237+
all:
238+
- has:
239+
stopBy: neighbor
240+
kind: simple_identifier
241+
regex: "^key$"
242+
- has:
243+
stopBy: neighbor
244+
kind: call_expression
245+
all:
246+
- has:
247+
stopBy: neighbor
248+
kind: simple_identifier
249+
regex: "^Array$"
250+
- has:
251+
stopBy: neighbor
252+
kind: call_suffix
253+
has:
254+
stopBy: end
255+
kind: value_argument
256+
has:
257+
stopBy: neighbor
258+
kind: navigation_expression
259+
all:
260+
- has:
261+
stopBy: neighbor
262+
kind: line_string_literal
263+
has:
264+
stopBy: neighbor
265+
kind: line_str_text
266+
- has:
267+
stopBy: neighbor
268+
kind: navigation_suffix
269+
has:
270+
stopBy: neighbor
271+
kind: simple_identifier
272+
regex: "^utf8$"
273+
rule:
274+
any:
275+
- kind: try_expression
276+
any:
277+
- matches: match_pattern_try_expression_directly
278+
- matches: match_pattern_try_expression_with_instance
279+
- matches: match_pattern_try_expression_with_utf8
280+
281+
- kind: call_expression
282+
any:
283+
- matches: match_pattern_AES_statement_directly
284+
- matches: match_pattern_AES_expression_with_instance
285+
- matches: match_pattern_AES_expression_with_utf8

‎tests/__snapshots__/aes-hardcoded-secret-swift-snapshot.yml

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
id: aes-hardcoded-secret-swift
2+
snapshots:
3+
? |
4+
let password: Array<UInt8> = Array("s33krit".utf8)
5+
try AES(key: password, iv: "123")
6+
: labels:
7+
- source: 'try AES(key: password, iv: "123")'
8+
style: primary
9+
start: 51
10+
end: 84
11+
- source: AES
12+
style: secondary
13+
start: 55
14+
end: 58
15+
- source: key
16+
style: secondary
17+
start: 59
18+
end: 62
19+
- source: password
20+
style: secondary
21+
start: 64
22+
end: 72
23+
- source: 'key: password'
24+
style: secondary
25+
start: 59
26+
end: 72
27+
- source: '(key: password, iv: "123")'
28+
style: secondary
29+
start: 58
30+
end: 84
31+
- source: '(key: password, iv: "123")'
32+
style: secondary
33+
start: 58
34+
end: 84
35+
- source: 'AES(key: password, iv: "123")'
36+
style: secondary
37+
start: 55
38+
end: 84
39+
- source: password
40+
style: secondary
41+
start: 4
42+
end: 12
43+
- source: password
44+
style: secondary
45+
start: 4
46+
end: 12
47+
- source: Array("s33krit".utf8)
48+
style: secondary
49+
start: 29
50+
end: 50
51+
- source: 'let password: Array<UInt8> = Array("s33krit".utf8)'
52+
style: secondary
53+
start: 0
54+
end: 50
55+
? |
56+
try AES(key: "hello", iv: "123")
57+
: labels:
58+
- source: 'try AES(key: "hello", iv: "123")'
59+
style: primary
60+
start: 0
61+
end: 32
62+
- source: AES
63+
style: secondary
64+
start: 4
65+
end: 7
66+
- source: key
67+
style: secondary
68+
start: 8
69+
end: 11
70+
- source: hello
71+
style: secondary
72+
start: 14
73+
end: 19
74+
- source: '"hello"'
75+
style: secondary
76+
start: 13
77+
end: 20
78+
- source: 'key: "hello"'
79+
style: secondary
80+
start: 8
81+
end: 20
82+
- source: '(key: "hello", iv: "123")'
83+
style: secondary
84+
start: 7
85+
end: 32
86+
- source: '(key: "hello", iv: "123")'
87+
style: secondary
88+
start: 7
89+
end: 32
90+
- source: 'AES(key: "hello", iv: "123")'
91+
style: secondary
92+
start: 4
93+
end: 32

‎tests/swift/aes-hardcoded-secret-swift-test.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
id: aes-hardcoded-secret-swift
2+
valid:
3+
- |
4+
5+
invalid:
6+
- |
7+
let password: Array<UInt8> = Array("s33krit".utf8)
8+
try AES(key: password, iv: "123")
9+
- |
10+
try AES(key: "hello", iv: "123")

0 commit comments

Comments
 (0)