coderabbitai · ganeshpatro321 · Mar 26, 2025 · Dec 16, 2024 · Jan 6, 2025 · Jan 8, 2025
diff --git a/rules/python/security/python-requests-hardcoded-secret-python.yml b/rules/python/security/python-requests-hardcoded-secret-python.yml
@@ -0,0 +1,155 @@
+id: python-requests-hardcoded-secret-python
+severity: warning
+language: python
+message: >-
+  A secret is hard-coded in the application. Secrets stored in source
+  code, such as credentials, identifiers, and other types of sensitive data,
+  can be leaked and used by internal or external malicious actors. Use
+  environment variables to securely provide credentials and other secrets or
+  retrieve them from a secure vault or Hardware Security Module (HSM).
+note: >-
+  [CWE-798] Use of Hard-coded Credentials.
+  [REFERENCES]
+      - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+
+ast-grep-essentials: true
+
+utils:
+  requests.auth.HTTPBasicAuth($USER,"",...):
+    kind: call
+    all:
+      - has:
+          stopBy: neighbor
+          kind: attribute
+          regex: ^requests.auth.HTTPBasicAuth$|^requests.auth.HTTPDigestAuth$|^requests.auth.HTTPProxyAuth$
+      - has:
+          stopBy: neighbor
+          kind: argument_list
+          not:
+            has:
+              nthChild: 3
+          has:
+            stopBy: neighbor
+            kind: string
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: string_content
+
+  HTTPBasicAuth($USER,"",...):
+    kind: call
+    all:
+      - has:
+          stopBy: neighbor
+          kind: identifier
+          regex: ^(HTTPBasicAuth)$
+      - has:
+          stopBy: neighbor
+          kind: argument_list
+          not:
+            has:
+              nthChild: 3
+          has:
+            stopBy: neighbor
+            kind: string
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: string_content
+      - any:
+          - follows:
+              stopBy: end
+              kind: import_from_statement
+              any:
+                - pattern: from requests.auth import HTTPBasicAuth
+          - inside:
+              stopBy: end
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                any:
+                  - pattern: from requests.auth import HTTPBasicAuth
+
+  HTTPProxyAuth($USER,"",...):
+    kind: call
+    all:
+      - has:
+          stopBy: neighbor
+          kind: identifier
+          regex: ^(HTTPProxyAuth)$
+      - has:
+          stopBy: neighbor
+          kind: argument_list
+          not:
+            has:
+              nthChild: 3
+          has:
+            stopBy: neighbor
+            kind: string
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: string_content
+      - any:
+          - follows:
+              stopBy: end
+              kind: import_from_statement
+              any:
+                - pattern: from requests.auth import HTTPProxyAuth
+          - inside:
+              stopBy: end
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                any:
+                  - pattern: from requests.auth import HTTPProxyAuth
+
+  HTTPDigestAuth($USER,"",...):
+    kind: call
+    all:
+      - has:
+          stopBy: neighbor
+          kind: identifier
+          regex: ^(HTTPDigestAuth)$
+      - has:
+          stopBy: neighbor
+          kind: argument_list
+          not:
+            has:
+              nthChild: 3
+          has:
+            stopBy: neighbor
+            kind: string
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: string_content
+      - any:
+          - follows:
+              stopBy: end
+              kind: import_from_statement
+              any:
+                - pattern: from requests.auth import HTTPProxyAuth
+          - inside:
+              stopBy: end
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                any:
+                  - pattern: from requests.auth import HTTPDigestAuth
+
+rule:
+  kind: call
+  any:
+    - matches: HTTPProxyAuth($USER,"",...)
+    - matches: HTTPDigestAuth($USER,"",...)
+    - matches: HTTPBasicAuth($USER,"",...)
+    - matches: requests.auth.HTTPBasicAuth($USER,"",...)
+  not:
+    all:
+      - has:
+          stopBy: end
+          kind: ERROR
+      - inside:
+          stopBy: end
+          kind: ERROR