Skip to content

Add YAML AST-based security rules and tests for Python MySQL/Neo4j #180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Mar 24, 2025
Merged

Add YAML AST-based security rules and tests for Python MySQL/Neo4j #180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ce2758b
python-mysql-empty-password-python
Mar 24, 2025
4659d6b
python-mysql-hardcoded-secret-python
Mar 24, 2025
781af4d
python-neo4j-hardcoded-secret-auth-python
Mar 24, 2025
8e3fe57
python-neo4j-hardcoded-secret-python
Mar 24, 2025
231bf95
python-neo4j-empty-password-python
Mar 24, 2025
a25943c
Merge branch 'main' into mysql_neo4j_password_python
ganeshpatro321 Mar 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
202 changes: 202 additions & 0 deletions rules/python/security/python-mysql-empty-password-python.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,202 @@
id: python-mysql-empty-password-python
severity: warning
language: python
message: >-
The application creates a database connection with an empty password.
This can lead to unauthorized access by either an internal or external
malicious actor. To prevent this vulnerability, enforce authentication
when connecting to a database by using environment variables to securely
provide credentials or retrieving them from a secure vault or HSM
(Hardware Security Module).
note: >-
[CWE-287] Improper Authentication.
[REFERENCES]
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html

ast-grep-essentials: true

utils:
define_string:
kind: string
all:
- has:
kind: string_start
nthChild: 1
# - has:
# kind: string_content
# nthChild: 2
- has:
kind: string_end
nthChild: 2

define_password:
any:
- matches: define_string
- kind: identifier
pattern: $PWD_IDENTIFIER
inside:
stopBy: end
follows:
stopBy: end
kind: expression_statement
has:
stopBy: end
kind: assignment
nthChild: 1
all:
- has:
nthChild: 1
kind: identifier
field: left
pattern: $PWD_IDENTIFIER
- has:
nthChild: 2
matches: define_string

rule:
any:
- kind: call
any:
- kind: call
has:
kind: identifier
regex: ^connect$
precedes:
kind: argument_list
has:
stopBy: end
kind: keyword_argument
all:
- has:
nthChild: 1
kind: identifier
regex: ^(password|passwd)$
- has:
nthChild: 2
matches: define_password
inside:
stopBy: end
follows:
stopBy: end
kind: import_from_statement
all:
- has:
nthChild: 1
kind: dotted_name
field: module_name
regex: ^mysql.connector$
precedes:
stopBy: end
kind: dotted_name
regex: ^connect$
- kind: call
any:
- kind: call
has:
kind: identifier
pattern: $SASL_ALIAS
precedes:
kind: argument_list
has:
stopBy: end
kind: keyword_argument
all:
- has:
nthChild: 1
kind: identifier
regex: ^(password|passwd)$
- has:
nthChild: 2
matches: define_password
inside:
stopBy: end
follows:
stopBy: end
kind: import_from_statement
all:
- has:
nthChild: 1
kind: dotted_name
field: module_name
regex: ^mysql.connector$
precedes:
stopBy: end
kind: aliased_import
all:
- has:
kind: dotted_name
nthChild: 1
regex: ^connect$
- has:
kind: identifier
field: alias
nthChild: 2
pattern: $SASL_ALIAS
- kind: call
any:
- kind: call
has:
kind: attribute
all:
- has:
kind: identifier
field: object
nthChild: 1
pattern: $MYSQL_ALIAS
- has:
kind: identifier
field: attribute
nthChild: 2
regex: ^connect$
precedes:
kind: argument_list
has:
stopBy: end
kind: keyword_argument
all:
- has:
nthChild: 1
kind: identifier
regex: ^(password|passwd)$
- has:
nthChild: 2
matches: define_password
inside:
stopBy: end
follows:
stopBy: end
kind: import_statement
has:
nthChild: 1
kind: aliased_import
all:
- has:
nthChild: 1
kind: dotted_name
field: name
regex: ^mysql.connector$
precedes:
stopBy: end
kind: identifier
pattern: $MYSQL_ALIAS
- kind: call
any:
- kind: call
has:
kind: attribute
field: function
nthChild: 1
regex: ^mysql.connector.connect$
precedes:
kind: argument_list
has:
stopBy: end
kind: keyword_argument
all:
- has:
nthChild: 1
kind: identifier
regex: ^(password|passwd)$
- has:
nthChild: 2
matches: define_password
Loading