Skip to content

Commit 7f9f1af

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add security rules for detecting hard-coded secrets in Java and Python (#141)
* removed missing-secure-java * httponly-false-csharp * use-of-md5-digest-utils-java * removing use-of-md5-digest-utils and httponly-false-csharp * python-urllib3-hardcoded-secret-python * drivermanager-hardcoded-secret-java --------- Co-authored-by: Sakshis <[email protected]>
1 parent 991fa00 commit 7f9f1af

6 files changed

+287
-0
lines changed

‎rules/java/security/drivermanager-hardcoded-secret-java.yml

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
id: drivermanager-hardcoded-secret-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
15+
ast-grep-essentials: true
16+
17+
utils:
18+
MATCH_PATTERN_DriverManager.getConnection:
19+
kind: method_invocation
20+
all:
21+
- has:
22+
stopBy: neighbor
23+
kind: identifier
24+
regex: '^DriverManager$'
25+
- has:
26+
stopBy: neighbor
27+
kind: identifier
28+
regex: '^getConnection$'
29+
- has:
30+
kind: argument_list
31+
# nthChild: 3
32+
all:
33+
- any:
34+
- has:
35+
stopBy: end
36+
kind: string_literal
37+
nthChild: 3
38+
pattern: $I
39+
has:
40+
stopBy: neighbor
41+
kind: string_fragment
42+
- has:
43+
stopBy: end
44+
kind: parenthesized_expression
45+
has:
46+
stopBy: end
47+
kind: string_fragment
48+
pattern: $I
49+
- has:
50+
nthChild: 3
51+
all:
52+
- has:
53+
stopBy: neighbor
54+
kind: string_fragment
55+
inside:
56+
stopBy: neighbor
57+
kind: string_literal
58+
- not:
59+
has:
60+
stopBy: end
61+
kind: string_literal
62+
not:
63+
has:
64+
stopBy: neighbor
65+
kind: string_fragment
66+
- not:
67+
has:
68+
stopBy: end
69+
regex: ^-$
70+
- not:
71+
has:
72+
nthChild: 4
73+
- not:
74+
has:
75+
stopBy: end
76+
kind: ERROR
77+
- not:
78+
has:
79+
stopBy: end
80+
kind: binary_expression
81+
82+
MATCH_PATTERN_DriverManagerDataSource:
83+
kind: object_creation_expression
84+
all:
85+
- has:
86+
stopBy: neighbor
87+
kind: type_identifier
88+
regex: '^DriverManagerDataSource$'
89+
- has:
90+
kind: argument_list
91+
# nthChild: 3
92+
all:
93+
- any:
94+
- has:
95+
stopBy: neighbor
96+
kind: string_literal
97+
nthChild: 3
98+
pattern: $I
99+
has:
100+
stopBy: neighbor
101+
kind: string_fragment
102+
- has:
103+
stopBy: end
104+
kind: parenthesized_expression
105+
has:
106+
stopBy: end
107+
kind: string_fragment
108+
pattern: $I
109+
- has:
110+
nthChild: 3
111+
all:
112+
- has:
113+
stopBy: neighbor
114+
kind: string_fragment
115+
inside:
116+
stopBy: neighbor
117+
kind: string_literal
118+
- not:
119+
has:
120+
stopBy: end
121+
kind: string_literal
122+
not:
123+
has:
124+
stopBy: neighbor
125+
kind: string_fragment
126+
- not:
127+
has:
128+
stopBy: end
129+
regex: ^-$
130+
- not:
131+
has:
132+
nthChild: 4
133+
- not:
134+
has:
135+
stopBy: end
136+
kind: binary_expression
137+
- not:
138+
has:
139+
stopBy: end
140+
kind: ERROR
141+
142+
rule:
143+
any:
144+
- kind: method_invocation
145+
matches: MATCH_PATTERN_DriverManager.getConnection
146+
- kind: object_creation_expression
147+
matches: MATCH_PATTERN_DriverManagerDataSource
148+
149+
constraints:
150+
I:
151+
not:
152+
regex: ^""$
153+

‎rules/python/security/python-urllib3-hardcoded-secret-python.yml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
id: python-urllib3-hardcoded-secret-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
15+
ast-grep-essentials: true
16+
17+
utils:
18+
urllib3.util.make_headers(...,basic_auth="...",...):
19+
# urllib3.util.make_headers(...,basic_auth="...",...)
20+
kind: call
21+
all:
22+
- has:
23+
stopBy: neighbor
24+
kind: attribute
25+
regex: '^urllib3.util.make_headers$|^urllib3.make_headers$|^requests.packages.urllib3.make_headers$|^requests.packages.urllib3.util.make_headers$'
26+
- has:
27+
stopBy: neighbor
28+
kind: argument_list
29+
has:
30+
stopBy: neighbor
31+
kind: keyword_argument
32+
all:
33+
- has:
34+
stopBy: neighbor
35+
kind: identifier
36+
regex: '^basic_auth$|^proxy_basic_auth$'
37+
- has:
38+
stopBy: neighbor
39+
kind: string
40+
any:
41+
- has:
42+
stopBy: neighbor
43+
kind: string_content
44+
- has:
45+
stopBy: neighbor
46+
regex: '.*'
47+
48+
rule:
49+
kind: call
50+
matches: urllib3.util.make_headers(...,basic_auth="...",...)
51+
not:
52+
all:
53+
- has:
54+
stopBy: end
55+
kind: ERROR
56+
- inside:
57+
stopBy: end
58+
kind: ERROR
59+

‎tests/__snapshots__/drivermanager-hardcoded-secret-java-snapshot.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: drivermanager-hardcoded-secret-java
2+
snapshots:
3+
? |
4+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password");
5+
: labels:
6+
- source: DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password")
7+
style: primary
8+
start: 17
9+
end: 101
10+
- source: DriverManager
11+
style: secondary
12+
start: 17
13+
end: 30
14+
- source: getConnection
15+
style: secondary
16+
start: 31
17+
end: 44
18+
- source: password
19+
style: secondary
20+
start: 91
21+
end: 99
22+
- source: '"password"'
23+
style: secondary
24+
start: 90
25+
end: 100
26+
- source: ("jdbc:oracle:thin:@localhost:1521:o92", "a", "password")
27+
style: secondary
28+
start: 44
29+
end: 101

‎tests/__snapshots__/python-urllib3-hardcoded-secret-python-snapshot.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: python-urllib3-hardcoded-secret-python
2+
snapshots:
3+
urllib3.util.make_headers(basic_auth="user:123"):
4+
labels:
5+
- source: urllib3.util.make_headers(basic_auth="user:123")
6+
style: primary
7+
start: 0
8+
end: 48
9+
- source: urllib3.util.make_headers
10+
style: secondary
11+
start: 0
12+
end: 25
13+
- source: basic_auth
14+
style: secondary
15+
start: 26
16+
end: 36
17+
- source: user:123
18+
style: secondary
19+
start: 38
20+
end: 46
21+
- source: '"user:123"'
22+
style: secondary
23+
start: 37
24+
end: 47
25+
- source: basic_auth="user:123"
26+
style: secondary
27+
start: 26
28+
end: 47
29+
- source: (basic_auth="user:123")
30+
style: secondary
31+
start: 25
32+
end: 48

‎tests/java/drivermanager-hardcoded-secret-java-test.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
id: drivermanager-hardcoded-secret-java
2+
valid:
3+
- |
4+
Connection conn = DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92","a");
5+
invalid:
6+
- |
7+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password");

‎tests/python/python-urllib3-hardcoded-secret-python-test.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
id: python-urllib3-hardcoded-secret-python
2+
valid:
3+
- |
4+
urllib3.util.make_headers(basic_auth=os.env['auth'])
5+
invalid:
6+
- |
7+
urllib3.util.make_headers(basic_auth="user:123")

0 commit comments

Comments
 (0)