Add Ruby Cassandra security rules for empty and hardcoded passwords #147

ESS-ENN · 2025-02-04T12:38:52Z

Summary by CodeRabbit

New Features
- Added security rules to flag potential vulnerabilities from empty passwords and hardcoded secrets in Ruby applications using Cassandra.
Tests
- Introduced tests and snapshot validations to ensure these security checks perform as expected, reinforcing safer credential practices.

CLAassistant · 2025-02-04T12:38:59Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ ESS-ENN
❌ Sakshis

Sakshis seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

coderabbitai · 2025-02-04T12:39:00Z

Walkthrough

This pull request adds two new security rules for Ruby applications interfacing with Cassandra. One rule detects empty passwords in connection calls while the other identifies hardcoded secrets. In addition, snapshot configurations and test cases have been introduced to verify these rules. The rules leverage AST pattern matching on Cassandra.cluster() calls, checking for empty or hardcoded password arguments, and include detailed metadata referencing relevant CWE codes and OWASP resources.

Changes

File(s)	Change Summary
`rules/ruby/security/ruby-cassandra-empty-password-ruby.yml` `rules/ruby/security/ruby-cassandra-hardcoded-secret-ruby.yml`	Added new security rules for Ruby Cassandra connections: one to detect empty passwords (CWE-287) and one to flag hardcoded secrets (CWE-798) using AST pattern matching.
`tests/__snapshots__/ruby-cassandra-empty-password-ruby-snapshot.yml`	Introduced snapshot configurations that demonstrate code examples with empty passwords in Cassandra connection calls for testing purposes.
`tests/ruby/ruby-cassandra-empty-password-ruby-test.yml` `tests/ruby/ruby-cassandra-hardcoded-secret-ruby-test.yml`	Added test cases to validate both empty password and hardcoded secret scenarios in Ruby Cassandra connection calls.

Sequence Diagram(s)

sequenceDiagram
    participant Developer
    participant "Ruby Code"
    participant "AST Parser"
    participant "Security Rule Engine"
    participant Reporter

    Developer->>Ruby Code: Write Cassandra connection code
    Ruby Code->>AST Parser: Parse code into AST
    AST Parser->>Security Rule Engine: Provide AST nodes
    Security Rule Engine->>Security Rule Engine: Evaluate empty password and hardcoded secret rules
    Security Rule Engine->>Reporter: Flag potential vulnerabilities
    Reporter->>Developer: Display security warnings

Possibly related PRs

Add security rules for ARC4, hard-coded secrets, and passwords in Python and Ruby #71: Introduces a similar rule for detecting empty passwords and hardcoded secrets in Cassandra connections.
Delete security rule files for empty passwords in multiple languages #60: Implements empty password detection in JavaScript and Python, offering cross-language context for similar vulnerabilities.
Add Security Rules for Flask, Cassandra, and Couchbase in YAML Configs #65: Contains an empty password rule for Cassandra connections in Python, demonstrating a similar AST pattern matching approach.

Suggested reviewers

ganeshpatro321

Poem

I'm just a little rabbit, hopping in the code,
Scanning for clues where secrets once strode.
No empty passwords here, no hardcoded despair,
With AST magic, we mend the software layer.
Celebrate these secure hops—carrots and care! 🐇

Happy coding, nibble on change!

Tip

🌐 Web search-backed reviews and chat

We have enabled web search-based reviews and chat for all users. This feature allows CodeRabbit to access the latest documentation and information on the web.
You can disable this feature by setting web_search: false in the knowledge_base settings.
Please share any feedback in the Discord discussion.

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 26b3b09 and 1a39f83.

📒 Files selected for processing (5)

rules/ruby/security/ruby-cassandra-empty-password-ruby.yml (1 hunks)
rules/ruby/security/ruby-cassandra-hardcoded-secret-ruby.yml (1 hunks)
tests/__snapshots__/ruby-cassandra-empty-password-ruby-snapshot.yml (1 hunks)
tests/ruby/ruby-cassandra-empty-password-ruby-test.yml (1 hunks)
tests/ruby/ruby-cassandra-hardcoded-secret-ruby-test.yml (1 hunks)

🔇 Additional comments (17)

tests/ruby/ruby-cassandra-empty-password-ruby-test.yml (2)

1-4: Positive: Valid Test Case for Empty Password
The valid test snippet clearly illustrates a case where a Cassandra cluster is initiated with an empty password. This example is appropriately placed as a valid scenario for the empty-password rule.

5-12: Observation: Comprehensive Coverage for Invalid Scenarios
Two distinct invalid scenarios are provided—one using a direct literal and the other via a variable assignment—to ensure the rule flags empty password cases consistently. The YAML structure and indentation are correct, supporting clear separation between valid and invalid tests.

tests/ruby/ruby-cassandra-hardcoded-secret-ruby-test.yml (2)

1-4: Positive: Valid Test Case for Hardcoded Secret
This valid snippet shows a cluster instantiation that avoids a hardcoded password. Although it reuses an empty password similar to the empty-password case, it reflects the intent of the hardcoded secret rule by ensuring that a non-hardcoded (or absent) credential is used.

5-12: Observation: Detailed Invalid Cases for Hardcoded Secrets
The two invalid test cases simulate scenarios with hardcoded passwords in two different ways. This approach enhances test coverage by catching both direct inline hardcoding and assignments via a variable.

tests/__snapshots__/ruby-cassandra-empty-password-ruby-snapshot.yml (2)

1-47: Review: Snapshot for Direct Empty Password Case
The first snapshot block provides a detailed example with multiple label definitions. The labels (with corresponding start and end positions) appear carefully mapped to various code segments (e.g., Cassandra.cluster(...), password, and the empty string). Ensure that these positions correctly match the expected AST spans when the snapshot is re-generated.

47-107: Review: Snapshot for Variable-based Empty Password Case
The second snapshot block covers the scenario where the password is stored in a variable before being passed to Cassandra.cluster(). The extensive label definitions again help isolate key substrings. Verify that the positional metadata (start/end ranges) aligns with the actual parsed output during tests.

rules/ruby/security/ruby-cassandra-hardcoded-secret-ruby.yml (5)

1-3: Metadata Verification: Rule Identification and Severity
The header correctly defines the rule ID, language, and severity level. Using “warning” here is appropriate given the sensitive nature of hardcoded credentials.

4-14: Review: Message and Note Clarity
The explanatory message and accompanying note (with CWE and reference link) clearly articulate the risks associated with hardcoded secrets. This context is valuable for developers and security auditors alike.

15-64: Observation: AST Pattern for Cassandra.cluster()
The utility block for Cassandra.cluster() is well defined with a series of AST matching conditions that target the constant, identifier, and the argument list structure. The nested conditions (e.g., for hash_key_symbol or simple_symbol for the password key) are precise. Please verify that these conditions cover all practical code variants.

65-108: Observation: Pattern for Cassandra.cluster()_Instance
The pattern for Cassandra.cluster()_Instance mirrors the earlier block and appropriately extends the rule to instance-based calls. The inclusion of assignment checks for variable usage improves the rule’s robustness against false negatives.

135-147: Review: Rule Definition Logic
The final rule block successfully consolidates matches for both call forms and excludes cases marked with errors. This structure ensures that the rule will only flag genuine instances of hardcoded secrets.

rules/ruby/security/ruby-cassandra-empty-password-ruby.yml (6)

1-3: Metadata Verification: Rule Identification and Severity for Empty Password Case
The header information—ID, language, and severity—appropriately reflects the context of an empty password vulnerability.

4-10: Review: Clear Description in Message Field
The message field concisely explains the risk associated with using an empty password and provides actionable advice (using env variables or vaults). This clarity supports developer understanding.

11-14: Observation: CWE and Reference Documentation
The note field properly cites CWE-287 and offers a reference link to an OWASP cheat sheet, which is instrumental for further remediation.

16-64: Observation: AST Utility for Cassandra.cluster()
The AST pattern described for Cassandra.cluster() checks for an empty string in the password pair. The conditions using not: has: string_content correctly aim to flag empty passwords. Ensure the regex and AST matching logic work as intended in varied Ruby code cases.

66-109: Observation: AST Utility for Cassandra.cluster()_Instance
Similar to the previous block, this section handles instance calls including variable references. The check using not: has: string_content is a good mechanism to capture an empty password.

138-151: Review: Consolidated Rule Logic
The consolidated rule block efficiently combines matching for both forms of the Cassandra cluster function calls and excludes erroneous cases. This symmetry with the hardcoded secret rule enhances consistency across rules.

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Generate unit testing code for this file.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit testing code for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and generate unit testing code.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR. (Beta)
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

Sakshis and others added 17 commits December 16, 2024 13:09

removed missing-secure-java

bb7b8e1

Merge branch 'coderabbitai:main' into main

308e947

Merge branch 'coderabbitai:main' into main

46efd55

Merge branch 'coderabbitai:main' into main

3ac0204

Merge branch 'coderabbitai:main' into main

7caba92

Merge branch 'coderabbitai:main' into main

d3a2776

Merge branch 'coderabbitai:main' into main

2e86380

Merge branch 'coderabbitai:main' into main

b072db7

Merge branch 'coderabbitai:main' into main

65dce29

httponly-false-csharp

12bb3aa

use-of-md5-digest-utils-java

2c5ea88

removing use-of-md5-digest-utils and httponly-false-csharp

d3067f1

Merge branch 'coderabbitai:main' into main

56d4011

Merge branch 'coderabbitai:main' into main

f7f1d72

Merge branch 'coderabbitai:main' into main

0d53f8e

ruby-cassandra-empty-password-ruby

3867ff9

ruby-cassandra-hardcoded-secret-ruby

1a39f83

coderabbitai bot changed the title ~~@coderabbitai~~ Add Ruby Cassandra security rules for empty and hardcoded passwords Feb 4, 2025

coderabbitai bot approved these changes Feb 4, 2025

View reviewed changes

ganeshpatro321 approved these changes Feb 5, 2025

View reviewed changes

ganeshpatro321 merged commit 895f00b into coderabbitai:main Feb 5, 2025
1 of 2 checks passed

coderabbitai bot mentioned this pull request Feb 6, 2025

Add security rules and YAML configs for detecting hard-coded secrets #149

Merged

coderabbitai bot mentioned this pull request Mar 4, 2025

Add mysql2 security rules for empty passwords and hard-coded secrets #166

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Ruby Cassandra security rules for empty and hardcoded passwords #147

Add Ruby Cassandra security rules for empty and hardcoded passwords #147

Uh oh!

ESS-ENN commented Feb 4, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

CLAassistant commented Feb 4, 2025

Uh oh!

coderabbitai bot commented Feb 4, 2025 •

edited

Loading

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

Uh oh!

Uh oh!

Uh oh!

Add Ruby Cassandra security rules for empty and hardcoded passwords #147

Add Ruby Cassandra security rules for empty and hardcoded passwords #147

Uh oh!

Conversation

ESS-ENN commented Feb 4, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

CLAassistant commented Feb 4, 2025

Uh oh!

coderabbitai bot commented Feb 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Possibly related PRs

Suggested reviewers

Poem

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

Uh oh!

Uh oh!

ESS-ENN commented Feb 4, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Feb 4, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)