Skip to content

Commit fccc015

Browse files
author
Sakshis
committed
empty-password-rust
1 parent d3972fa commit fccc015

File tree

3 files changed

+1006
-0
lines changed

3 files changed

+1006
-0
lines changed

‎rules/rust/security/empty-password-rust.yml

Lines changed: 309 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,309 @@
1+
id: empty-password-rust
2+
language: rust
3+
severity: warning
4+
message: >-
5+
The application uses an empty credential. This can lead to unauthorized
6+
access by either an internal or external malicious actor. It is
7+
recommended to rotate the secret and retrieve them from a secure secret
8+
vault or Hardware Security Module (HSM), alternatively environment
9+
variables can be used if allowed by your company policy.
10+
note: >-
11+
[CWE-287]: Improper Authentication
12+
[REFERENCES]
13+
- https://docs.rs/sqlx/latest/sqlx/
14+
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
15+
utils:
16+
match_call_expression_with_mysqlconnections:
17+
kind: call_expression
18+
all:
19+
- has:
20+
kind: field_expression
21+
field: function
22+
has:
23+
stopBy: end
24+
kind: call_expression
25+
all:
26+
- has:
27+
stopBy: end
28+
kind: scoped_identifier
29+
all:
30+
- has:
31+
stopBy: end
32+
kind: identifier
33+
field: path
34+
regex: "^MySqlConnectOptions$"
35+
- has:
36+
stopBy: end
37+
field: name
38+
kind: identifier
39+
regex: "^new$"
40+
- has:
41+
kind: arguments
42+
- has:
43+
kind: arguments
44+
has:
45+
kind: string_literal
46+
inside:
47+
kind: field_expression
48+
has:
49+
kind: field_identifier
50+
field: field
51+
inside:
52+
kind: call_expression
53+
has:
54+
kind: arguments
55+
inside:
56+
kind: field_expression
57+
has:
58+
kind: field_identifier
59+
inside:
60+
kind: call_expression
61+
has:
62+
kind: arguments
63+
inside:
64+
kind: await_expression
65+
inside:
66+
kind: try_expression
67+
inside:
68+
kind: let_declaration
69+
inside:
70+
stopBy: end
71+
kind: function_item
72+
follows:
73+
stopBy: end
74+
kind: use_declaration
75+
has:
76+
kind: scoped_use_list
77+
all:
78+
- has:
79+
kind: scoped_identifier
80+
field: path
81+
all:
82+
- has:
83+
kind: identifier
84+
field: path
85+
regex: "^sqlx$"
86+
- has:
87+
kind: identifier
88+
field: name
89+
regex: "^mysql$"
90+
- has:
91+
kind: use_list
92+
field: list
93+
all:
94+
- has:
95+
kind: identifier
96+
regex: "^MySqlConnectOptions$"
97+
- has:
98+
kind: identifier
99+
regex: "^MySqlConnection$"
100+
- has:
101+
kind: identifier
102+
regex: "^MySqlPool$"
103+
- has:
104+
kind: identifier
105+
regex: "^MySqlSslMode$"
106+
match_call_expression_with_PgConnectOptions:
107+
kind: call_expression
108+
all:
109+
- has:
110+
stopBy: end
111+
kind: field_expression
112+
has:
113+
stopBy: end
114+
kind: call_expression
115+
all:
116+
- has:
117+
stopBy: end
118+
kind: scoped_identifier
119+
all:
120+
- has:
121+
stopBy: end
122+
kind: identifier
123+
field: path
124+
regex: "^PgConnectOptions$"
125+
- has:
126+
stopBy: end
127+
field: name
128+
kind: identifier
129+
regex: "^new$"
130+
- has:
131+
kind: arguments
132+
- has:
133+
kind: arguments
134+
not:
135+
has:
136+
stopBy: end
137+
kind: string_literal
138+
has:
139+
stopBy: end
140+
kind: string_content
141+
inside:
142+
kind: field_expression
143+
has:
144+
kind: field_identifier
145+
inside:
146+
kind: call_expression
147+
has:
148+
kind: arguments
149+
inside:
150+
kind: field_expression
151+
has:
152+
kind: field_identifier
153+
inside:
154+
kind: call_expression
155+
has:
156+
kind: arguments
157+
inside:
158+
kind: await_expression
159+
inside:
160+
kind: try_expression
161+
inside:
162+
kind: let_declaration
163+
inside:
164+
stopBy: end
165+
kind: function_item
166+
follows:
167+
stopBy: end
168+
kind: use_declaration
169+
has:
170+
kind: scoped_use_list
171+
all:
172+
- has:
173+
kind: scoped_identifier
174+
field: path
175+
all:
176+
- has:
177+
kind: identifier
178+
field: path
179+
regex: "^sqlx$"
180+
- has:
181+
kind: identifier
182+
field: name
183+
regex: "^postgres$"
184+
- has:
185+
kind: use_list
186+
field: list
187+
all:
188+
- has:
189+
kind: identifier
190+
regex: "^PgConnectOptions$"
191+
- has:
192+
kind: identifier
193+
regex: "^PgConnection$"
194+
- has:
195+
kind: identifier
196+
regex: "^PgPool$"
197+
- has:
198+
kind: identifier
199+
regex: "^PgSslMode$"
200+
match_call_expression_with_instance_PgConnectOptions:
201+
kind: call_expression
202+
all:
203+
- has:
204+
kind: field_expression
205+
all:
206+
- has:
207+
kind: call_expression
208+
has:
209+
kind: field_expression
210+
all:
211+
- has:
212+
stopBy: end
213+
kind: identifier
214+
field: value
215+
pattern: $PG
216+
- has:
217+
kind: field_identifier
218+
- has:
219+
kind: field_identifier
220+
- has:
221+
kind: arguments
222+
inside:
223+
kind: field_expression
224+
has:
225+
kind: field_identifier
226+
inside:
227+
kind: call_expression
228+
has:
229+
kind: arguments
230+
inside:
231+
kind: field_expression
232+
has:
233+
kind: field_identifier
234+
inside:
235+
kind: call_expression
236+
has:
237+
kind: arguments
238+
inside:
239+
kind: await_expression
240+
inside:
241+
kind: try_expression
242+
inside:
243+
kind: let_declaration
244+
follows:
245+
stopBy: end
246+
kind: let_declaration
247+
all:
248+
- has:
249+
kind: identifier
250+
pattern: $PG
251+
- has:
252+
kind: call_expression
253+
all:
254+
- has:
255+
kind: scoped_identifier
256+
all:
257+
- has:
258+
kind: identifier
259+
field: path
260+
regex: "^PgConnectOptions$"
261+
- has:
262+
kind: identifier
263+
field: name
264+
regex: "^new$"
265+
- has:
266+
kind: arguments
267+
inside:
268+
stopBy: end
269+
kind: function_item
270+
follows:
271+
stopBy: end
272+
kind: use_declaration
273+
has:
274+
kind: scoped_use_list
275+
all:
276+
- has:
277+
kind: scoped_identifier
278+
field: path
279+
all:
280+
- has:
281+
kind: identifier
282+
field: path
283+
regex: "^sqlx$"
284+
- has:
285+
kind: identifier
286+
field: name
287+
regex: "^postgres$"
288+
- has:
289+
kind: use_list
290+
field: list
291+
all:
292+
- has:
293+
kind: identifier
294+
regex: "^PgConnectOptions$"
295+
- has:
296+
kind: identifier
297+
regex: "^PgConnection$"
298+
- has:
299+
kind: identifier
300+
regex: "^PgPool$"
301+
- has:
302+
kind: identifier
303+
regex: "^PgSslMode$"
304+
305+
rule:
306+
any:
307+
- matches: match_call_expression_with_mysqlconnections
308+
- matches: match_call_expression_with_PgConnectOptions
309+
- matches: match_call_expression_with_instance_PgConnectOptions

0 commit comments

Comments
 (0)