python-couchbase-empty-password-python.yml

id: python-couchbase-empty-password-python
language: python
severity: warning
message: >-
  The application creates a database connection with an empty password.
  This can lead to unauthorized access by either an internal or external
  malicious actor. To prevent this vulnerability, enforce authentication
  when connecting to a database by using environment variables to securely
  provide credentials or retrieving them from a secure vault or HSM
  (Hardware Security Module).
note: >-
  [CWE-287]: Improper Authentication
  [OWASP A07:2021]: Identification and Authentication Failures
  [REFERENCES]
       https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
utils:
  match_passwordauthenticator:
    kind: call
    all:
      - has:
          kind: identifier
          pattern: $R
      - has:
          stopBy: neighbor
          kind: argument_list
          all:
            - has:
                stopBy: neighbor
                kind: string
                has:
                  stopBy: neighbor
                  kind: string_content
            - has:
                stopBy: neighbor
                kind: string
                not:
                  has:
                    stopBy: neighbor
                    kind: string_content

    inside:
      stopBy: end
      kind: expression_statement
      follows:
        stopBy: end
        kind: import_from_statement
        all:
          - has:
              stopBy: end
              kind: dotted_name
              field: module_name
              all:
                - has:
                    stopBy: end
                    kind: identifier
                    regex: couchbase_core
                - has:
                    stopBy: end
                    kind: identifier
                    regex: cluster
          - has:
              stopBy: end
              kind: dotted_name
              field: name
              has:
                stopBy: end
                kind: identifier
                pattern: $R
                regex: PasswordAuthenticator
rule:
  all:
    - matches: match_passwordauthenticator