tests/python/python-mysqlclient-hardcoded-secret-python-test.yml (1)

8-33: Consider adding more test cases for environment variables.

While the invalid test cases cover various ways of hardcoding passwords, consider adding test cases that demonstrate the recommended approach using environment variables (e.g., os.getenv('DB_PASSWORD')).

Example of a recommended test case:

valid:
  - |
    from MySQLdb import _mysql as mysql
    import os
    db = mysql.connect(
      host=FLAGS.host, user=FLAGS.user, passwd=os.getenv('DB_PASSWORD'), db=FLAGS.db
    )

rules/python/security/python-mysqlclient-hardcoded-secret-python.yml (1)

12-240: Consider enhancing the rule patterns.

The rule effectively catches hardcoded passwords but could be improved to:

1. Detect string concatenation in passwords (e.g., "pass" + "word")
2. Recognize more string patterns (e.g., f-strings, raw strings)

rules/python/security/python-neo4j-empty-password-python.yml (1)

12-98: Consider enhancing the rule to catch more edge cases.

While the current implementation effectively catches empty string literals, it might miss some edge cases:

1. String concatenation resulting in empty strings
2. Empty strings passed through variables
3. Empty strings from environment variables

Consider extending the rule to handle these cases. Would you like me to provide examples of these patterns to help expand the rule coverage?

tests/python/python-neo4j-hardcoded-secret-auth-python-test.yml (1)

Line range hint 1-98: Architectural Recommendation: Consider a shared test utilities module.

Given that both test files share similar patterns and structures, consider:

1. Creating a shared test utilities module to maintain consistency
2. Implementing helper functions for common test patterns
3. Adding documentation about the expected structure of valid/invalid test cases

This would help prevent issues like the reversed test sections and make the test suite more maintainable.

Would you like me to provide an example structure for this shared test utilities module?

rules/python/security/python-neo4j-hardcoded-secret-auth-python.yml (1)

12-104: Consider enhancing the string pattern matching.

While the rule effectively detects hard-coded secrets, it could be improved to handle more edge cases.

Consider adding these patterns to the rule:

 rule:
   kind: call
   any:
     - all:
         - has:
             nthChild: 1
             kind: identifier
             value: function
             any:
               - regex: ^(kerberos_auth|bearer_auth)$
+              - regex: ^(Auth\.kerberos|Auth\.bearer)$  # Handle Auth class methods
               - pattern: $ALIAS1

tests/__snapshots__/python-neo4j-hardcoded-secret-auth-python-snapshot.yml (1)

4-298: Consider using a more complex password in test cases.

Using "password" as the test password might not effectively demonstrate the detection of real-world hardcoded secrets.

Consider using a more realistic password pattern like "MyS3cret!P@ssw0rd" to better represent actual hardcoded secrets in production code.

Configuration used: CodeRabbit UI
Review profile: CHILL