tests/python/python-mysql-empty-password-python-test.yml (1)

6-13: Consider adding more test cases for comprehensive coverage.

While the current invalid test cases cover basic scenarios, consider adding tests for:

• Connection with password=None
• Connection with password parameter omitted
• Connection using connection string format

Example additions:

invalid:
  - |
    import mysql.connector
    conn = mysql.connector.connect(username="abcz", passwd="")
  - |
    import mysql.connector as mysql123
    def my_function():
      mysql123.connect(host="localhost",user="root",passwd="",database="aaa")
+  - |
+    import mysql.connector
+    conn = mysql.connector.connect(username="abcz", passwd=None)
+  - |
+    import mysql.connector
+    conn = mysql.connector.connect(username="abcz")
+  - |
+    import mysql.connector
+    conn = mysql.connector.connect("mysql://user@localhost/db")

tests/python/python-mysqlclient-empty-password-python-test.yml (1)

8-33: LGTM! Comprehensive coverage of invalid cases.

The invalid test cases provide excellent coverage of different connection patterns and empty password scenarios, including:

• Named parameter connections
• Positional parameter connections
• Different import styles and aliases
• Various MySQLdb connection methods

However, the FLAGS object in some test cases should be replaced with concrete values or environment variables to ensure test reliability.

rules/python/security/python-mysql-empty-password-python.yml (1)

12-88: Enhance pattern matching for additional empty password scenarios

The rule effectively catches direct empty string passwords but could be enhanced to detect additional scenarios:

1. String concatenation resulting in empty strings
2. F-strings that evaluate to empty strings
3. None/null passwords
4. Empty environment variables

Consider adding patterns for these scenarios to make the rule more robust. Would you like me to provide the additional pattern definitions?

tests/__snapshots__/python-mysql-empty-password-python-snapshot.yml (1)

1-107: Add test cases for edge cases and variations

While the current test cases cover basic empty password scenarios, consider adding test cases for:

1. Multi-line connection strings
2. Connection parameters from variables
3. Different string quote styles (single/double/triple quotes)
4. Dictionary-based connection parameters

Would you like me to provide examples of these additional test cases?

tests/__snapshots__/python-mysql-hardcoded-secret-python-snapshot.yml (1)

4-5: Use more secure example credentials in test cases

Even in test cases, it's recommended to use obviously fake credentials (e.g., "TEST_PASSWORD_123") rather than simple strings like "abc" to prevent accidental copy-paste into production code.

-    conn = mysql.connector.connect(username="abcz", passwd="abc")
+    conn = mysql.connector.connect(username="test_user", passwd="TEST_PASSWORD_123")

-      mysql123.connect(host="localhost",user="root",passwd="abc",database="aaa")
+      mysql123.connect(host="localhost",user="test_user",passwd="TEST_PASSWORD_123",database="test_db")

Also applies to: 56-58

rules/python/security/python-mysql-hardcoded-secret-python.yml (1)

12-94: Consider expanding pattern matching for connection strings.

While the rule effectively catches hardcoded secrets in keyword arguments, it might miss secrets in connection strings (e.g., mysql://user:password@host/db).

Consider adding a pattern to detect connection strings:

 rule:
   any:
+    - kind: string
+      regex: mysql:\/\/[^:]+:[^@]+@
     - kind: call
       has:
         kind: attribute

tests/__snapshots__/python-mysqlclient-empty-password-python-snapshot.yml (1)

1-350: Enhance test coverage with additional scenarios.

While the current test cases provide good coverage for empty string passwords, consider adding:

1. Tests for None/null passwords
2. Tests with connection string formats
3. Tests with environment variable usage (negative cases)

Add these test cases:

# Test None password
import MySQLdb
db = MySQLdb.connect(host="localhost", user="root", passwd=None)

# Test connection string
import MySQLdb
db = MySQLdb.connect("mysql://user:@localhost/db")

# Test environment variable (should not trigger)
import MySQLdb
import os
db = MySQLdb.connect(passwd=os.getenv('DB_PASSWORD'))

Configuration used: CodeRabbit UI
Review profile: CHILL