Skip to content

Commit 26b3b09

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add security rules for detecting password vulnerabilities in Python (#146)
* removed missing-secure-java * httponly-false-csharp * use-of-md5-digest-utils-java * removing use-of-md5-digest-utils and httponly-false-csharp * python-pymongo-empty-password-python * python-pymongo-hardcoded-secret-python * python-webrepl-empty-password-python * python-webrepl-hardcoded-secret-python --------- Co-authored-by: Sakshis <[email protected]>
1 parent 125cecc commit 26b3b09

12 files changed

+470
-0
lines changed

‎rules/python/security/python-pymongo-empty-password-python.yml

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
id: python-pymongo-empty-password-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
The application creates a database connection with an empty password.
6+
This can lead to unauthorized access by either an internal or external
7+
malicious actor. To prevent this vulnerability, enforce authentication
8+
when connecting to a database by using environment variables to securely
9+
provide credentials or retrieving them from a secure vault or HSM
10+
(Hardware Security Module).
11+
note: >-
12+
[CWE-287]: Improper Authentication
13+
[OWASP A07:2021]: Identification and Authentication Failures
14+
[REFERENCES]
15+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
16+
17+
ast-grep-essentials: true
18+
19+
utils:
20+
pymongo.MongoClient(..., password="",...):
21+
kind: call
22+
all:
23+
- has:
24+
stopBy: neighbor
25+
kind: attribute
26+
regex: ^pymongo.MongoClient$
27+
- has:
28+
stopBy: neighbor
29+
kind: argument_list
30+
has:
31+
stopBy: neighbor
32+
kind: keyword_argument
33+
all:
34+
- has:
35+
stopBy: neighbor
36+
kind: identifier
37+
regex: ^password$
38+
- has:
39+
stopBy: neighbor
40+
kind: string
41+
not:
42+
has:
43+
stopBy: end
44+
kind: string_content
45+
# $pymongo.MongoClient(..., password="",...):
46+
# kind: call
47+
# all:
48+
# - has:
49+
# stopBy: neighbor
50+
# kind: identifier
51+
# regex: ^MongoClient$
52+
# - has:
53+
# stopBy: neighbor
54+
# kind: argument_list
55+
# has:
56+
# stopBy: neighbor
57+
# kind: keyword_argument
58+
# all:
59+
# - has:
60+
# stopBy: neighbor
61+
# kind: identifier
62+
# regex: ^password$
63+
# - has:
64+
# stopBy: neighbor
65+
# kind: string
66+
# not:
67+
# has:
68+
# stopBy: end
69+
# kind: string_content
70+
# - inside:
71+
# stopBy: end
72+
# follows:
73+
# stopBy: end
74+
# kind: import_from_statement
75+
# pattern: from pymongo import MongoClient
76+
rule:
77+
kind: call
78+
any:
79+
- matches: pymongo.MongoClient(..., password="",...)
80+
# - matches: $pymongo.MongoClient(..., password="",...)
81+
not:
82+
all:
83+
- has:
84+
stopBy: end
85+
kind: ERROR
86+
- inside:
87+
stopBy: end
88+
kind: ERROR

‎rules/python/security/python-pymongo-hardcoded-secret-python.yml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
id: python-pymongo-hardcoded-secret-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798]: Use of Hard-coded Credentials
12+
[OWASP A07:2021]: Identification and Authentication Failures
13+
[REFERENCES]
14+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
16+
ast-grep-essentials: true
17+
18+
utils:
19+
pymongo.MongoClient(..., password="",...):
20+
kind: call
21+
all:
22+
- has:
23+
stopBy: neighbor
24+
kind: attribute
25+
regex: ^pymongo.MongoClient$
26+
- has:
27+
stopBy: neighbor
28+
kind: argument_list
29+
has:
30+
stopBy: neighbor
31+
kind: keyword_argument
32+
all:
33+
- has:
34+
stopBy: neighbor
35+
kind: identifier
36+
regex: ^password$
37+
- has:
38+
stopBy: neighbor
39+
kind: string
40+
has:
41+
stopBy: end
42+
kind: string_content
43+
# $pymongo.MongoClient(..., password="",...):
44+
# kind: call
45+
# all:
46+
# - has:
47+
# stopBy: neighbor
48+
# kind: identifier
49+
# regex: ^MongoClient$
50+
# - has:
51+
# stopBy: neighbor
52+
# kind: argument_list
53+
# has:
54+
# stopBy: neighbor
55+
# kind: keyword_argument
56+
# all:
57+
# - has:
58+
# stopBy: neighbor
59+
# kind: identifier
60+
# regex: ^password$
61+
# - has:
62+
# stopBy: neighbor
63+
# kind: string
64+
# has:
65+
# stopBy: end
66+
# kind: string_content
67+
# - inside:
68+
# stopBy: end
69+
# follows:
70+
# stopBy: end
71+
# kind: import_from_statement
72+
# pattern: from pymongo import MongoClient
73+
rule:
74+
kind: call
75+
any:
76+
- matches: pymongo.MongoClient(..., password="",...)
77+
# - matches: $pymongo.MongoClient(..., password="",...)
78+
not:
79+
all:
80+
- has:
81+
stopBy: end
82+
kind: ERROR
83+
- inside:
84+
stopBy: end
85+
kind: ERROR

‎rules/python/security/python-webrepl-empty-password-python.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
id: python-webrepl-empty-password-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
The application creates a database connection with an empty password.
6+
This can lead to unauthorized access by either an internal or external
7+
malicious actor. To prevent this vulnerability, enforce authentication
8+
when connecting to a database by using environment variables to securely
9+
provide credentials or retrieving them from a secure vault or HSM
10+
(Hardware Security Module).
11+
note: >-
12+
[CWE-287]: Improper Authentication
13+
[OWASP A07:2021]: Identification and Authentication Failures
14+
[REFERENCES]
15+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
16+
17+
ast-grep-essentials: true
18+
19+
utils:
20+
webrepl.start(..., password="",...):
21+
kind: call
22+
all:
23+
- has:
24+
stopBy: neighbor
25+
kind: attribute
26+
regex: ^webrepl.start$
27+
- has:
28+
stopBy: neighbor
29+
kind: argument_list
30+
has:
31+
stopBy: neighbor
32+
kind: keyword_argument
33+
all:
34+
- has:
35+
stopBy: neighbor
36+
kind: identifier
37+
regex: ^password$
38+
- has:
39+
stopBy: neighbor
40+
kind: string
41+
not:
42+
has:
43+
stopBy: end
44+
kind: string_content
45+
rule:
46+
kind: call
47+
matches: webrepl.start(..., password="",...)
48+
not:
49+
all:
50+
- has:
51+
stopBy: end
52+
kind: ERROR
53+
- inside:
54+
stopBy: end
55+
kind: ERROR
56+

‎rules/python/security/python-webrepl-hardcoded-secret-python.yml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
id: python-webrepl-hardcoded-secret-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798]: Use of Hard-coded Credentials
12+
[OWASP A07:2021]: Identification and Authentication Failures
13+
[REFERENCES]
14+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
16+
ast-grep-essentials: true
17+
18+
utils:
19+
webrepl.start(..., password="",...):
20+
kind: call
21+
all:
22+
- has:
23+
stopBy: neighbor
24+
kind: attribute
25+
regex: ^webrepl.start$
26+
- has:
27+
stopBy: neighbor
28+
kind: argument_list
29+
has:
30+
stopBy: neighbor
31+
kind: keyword_argument
32+
all:
33+
- has:
34+
stopBy: neighbor
35+
kind: identifier
36+
regex: ^password$
37+
- has:
38+
stopBy: neighbor
39+
kind: string
40+
has:
41+
stopBy: end
42+
kind: string_content
43+
rule:
44+
kind: call
45+
matches: webrepl.start(..., password="",...)
46+
not:
47+
all:
48+
- has:
49+
stopBy: end
50+
kind: ERROR
51+
- inside:
52+
stopBy: end
53+
kind: ERROR
54+

‎tests/__snapshots__/python-pymongo-empty-password-python-snapshot.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: python-pymongo-empty-password-python
2+
snapshots:
3+
? |
4+
pymongo.MongoClient(password="")
5+
: labels:
6+
- source: pymongo.MongoClient(password="")
7+
style: primary
8+
start: 0
9+
end: 32
10+
- source: pymongo.MongoClient
11+
style: secondary
12+
start: 0
13+
end: 19
14+
- source: password
15+
style: secondary
16+
start: 20
17+
end: 28
18+
- source: '""'
19+
style: secondary
20+
start: 29
21+
end: 31
22+
- source: password=""
23+
style: secondary
24+
start: 20
25+
end: 31
26+
- source: (password="")
27+
style: secondary
28+
start: 19
29+
end: 32

‎tests/__snapshots__/python-pymongo-hardcoded-secret-python-snapshot.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
id: python-pymongo-hardcoded-secret-python
2+
snapshots:
3+
? |
4+
pymongo.MongoClient(password="a")
5+
: labels:
6+
- source: pymongo.MongoClient(password="a")
7+
style: primary
8+
start: 0
9+
end: 33
10+
- source: pymongo.MongoClient
11+
style: secondary
12+
start: 0
13+
end: 19
14+
- source: password
15+
style: secondary
16+
start: 20
17+
end: 28
18+
- source: a
19+
style: secondary
20+
start: 30
21+
end: 31
22+
- source: '"a"'
23+
style: secondary
24+
start: 29
25+
end: 32
26+
- source: password="a"
27+
style: secondary
28+
start: 20
29+
end: 32
30+
- source: (password="a")
31+
style: secondary
32+
start: 19
33+
end: 33

‎tests/__snapshots__/python-webrepl-empty-password-python-snapshot.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: python-webrepl-empty-password-python
2+
snapshots:
3+
? |
4+
webrepl.start(password="")
5+
: labels:
6+
- source: webrepl.start(password="")
7+
style: primary
8+
start: 0
9+
end: 26
10+
- source: webrepl.start
11+
style: secondary
12+
start: 0
13+
end: 13
14+
- source: password
15+
style: secondary
16+
start: 14
17+
end: 22
18+
- source: '""'
19+
style: secondary
20+
start: 23
21+
end: 25
22+
- source: password=""
23+
style: secondary
24+
start: 14
25+
end: 25
26+
- source: (password="")
27+
style: secondary
28+
start: 13
29+
end: 26

0 commit comments

Comments
 (0)