Add YAML rules and tests for detecting hard-coded secrets in C#

rules/csharp/security/npgsqlconnectionstringbuilder-hardcoded-secret-csharp.yml

@@ -0,0 +1,350 @@
+id: npgsqlconnectionstringbuilder-hardcoded-secret-csharp
+language: csharp
+severity: warning
+message: >-
+  A secret is hard-coded in the application. Secrets stored in source
+  code, such as credentials, identifiers, and other types of sensitive data,
+  can be leaked and used by internal or external malicious actors. Use
+  environment variables to securely provide credentials and other secrets or
+  retrieve them from a secure vault or Hardware Security Module (HSM).
+note: >-
+  [CWE-798]: Use of Hard-coded Credentials
+  [OWASP A07:2021]: Identification and Authentication Failures
+  [REFERENCES]
+       https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+
+ast-grep-essentials: true
+
+utils:
+  match_NpgsqlConnectionStringBuilder_with_string:
+    kind: assignment_expression
+    all:
+      - has:
+          kind: member_access_expression
+          all:
+            - has:
+                kind: identifier
+                field: expression
+                pattern: $U
+            - has:
+                kind: identifier
+                field: name
+                regex: "^Password$"
+      - has:
+          kind: string_literal
+    inside:
+      stopBy: end
+      follows:
+        stopBy: end
+        kind: local_declaration_statement
+        has:
+          kind: variable_declaration
+          all:
+            - has:
+                kind: identifier
+                regex: "^NpgsqlConnectionStringBuilder$"
+            - has:
+                kind: variable_declarator
+                all:
+                  - has:
+                      kind: identifier
+                      field: name
+                      pattern: $U
+                  - has:
+                      kind: object_creation_expression
+                      all:
+                        - has:
+                            kind: identifier
+                        - has:
+                            kind: argument_list
+
+  match_with_brackets:
+    kind: assignment_expression
+    all:
+      - has:
+          kind: element_access_expression
+          all:
+            - has:
+                kind: identifier
+                pattern: $U
+            - has:
+                kind: bracketed_argument_list
+                has:
+                  kind: argument
+                  has:
+                    kind: string_literal
+                    has:
+                      kind: string_literal_content
+      - has:
+          kind: string_literal
+    inside:
+      stopBy: end
+      follows:
+        stopBy: end
+        kind: local_declaration_statement
+        has:
+          kind: variable_declaration
+          all:
+            - has:
+                kind: identifier
+                regex: "^NpgsqlConnectionStringBuilder$"
+            - has:
+                kind: variable_declarator
+                all:
+                  - has:
+                      kind: identifier
+                      field: name
+                      pattern: $U
+                  - has:
+                      kind: object_creation_expression
+                      all:
+                        - has:
+                            kind: identifier
+                        - has:
+                            kind: argument_list
+
+  match_instance_with_braces:
+    kind: assignment_expression
+    all:
+      - has:
+          kind: element_access_expression
+          all:
+            - has:
+                kind: identifier
+                pattern: $C
+            - has:
+                kind: bracketed_argument_list
+                has:
+                  kind: argument
+                  has:
+                    kind: string_literal
+                    has:
+                      kind: string_literal_content
+      - has:
+          kind: string_literal
+    inside:
+      stopBy: end
+      follows:
+        stopBy: end
+        kind: local_declaration_statement
+        has:
+          kind: variable_declaration
+          has:
+            kind: variable_declarator
+            all:
+              - has:
+                  kind: identifier
+                  pattern: $C
+              - has:
+                  kind: object_creation_expression
+                  all:
+                    - has:
+                        kind: identifier
+                        regex: "^NpgsqlConnectionStringBuilder$"
+                    - has:
+                        kind: argument_list
+
+  match_instance_without_braces:
+    kind: assignment_expression
+    all:
+      - has:
+          kind: member_access_expression
+          all:
+            - has:
+                kind: identifier
+                field: expression
+                pattern: $E
+            - has:
+                kind: identifier
+                field: name
+                regex: "^Password$"
+      - has:
+          kind: string_literal
+    inside:
+      stopBy: end
+      follows:
+        stopBy: end
+        kind: local_declaration_statement
+        has:
+          kind: variable_declaration
+          has:
+            kind: variable_declarator
+            all:
+              - has:
+                  kind: identifier
+                  pattern: $E
+              - has:
+                  kind: object_creation_expression
+                  all:
+                    - has:
+                        kind: identifier
+                        regex: "^NpgsqlConnectionStringBuilder$"
+                    - has:
+                        kind: argument_list
+
+  braces_instance:
+    kind: assignment_expression
+    all:
+      - has:
+          kind: element_access_expression
+          all:
+            - has:
+                kind: identifier
+                pattern: $Y
+            - has:
+                kind: bracketed_argument_list
+                has:
+                  kind: argument
+                  has:
+                    kind: string_literal
+                    has:
+                      kind: string_literal_content
+      - has:
+          kind: identifier
+          pattern: $P
+    inside:
+      stopBy: end
+      all:
+        - follows:
+            stopBy: end
+            kind: local_declaration_statement
+            has:
+              kind: variable_declaration
+              has:
+                kind: variable_declarator
+                all:
+                  - has:
+                      kind: identifier
+                      pattern: $Y
+                  - has:
+                      kind: object_creation_expression
+                      all:
+                        - has:
+                            kind: identifier
+                            regex: "^NpgsqlConnectionStringBuilder$"
+                        - has:
+                            kind: argument_list
+        - follows:
+            stopBy: end
+            kind: local_declaration_statement
+            has:
+              kind: variable_declaration
+              has:
+                kind: variable_declarator
+                all:
+                  - has:
+                      kind: identifier
+                      field: name
+                      pattern: $P
+                  - has:
+                      kind: string_literal
+
+  match_password_with_instance:
+    kind: assignment_expression
+    all:
+      - has:
+          kind: member_access_expression
+          all:
+            - has:
+                kind: identifier
+                field: expression
+                pattern: $K
+            - has:
+                kind: identifier
+                field: name
+                regex: "^Password$"
+      - has:
+          kind: identifier
+          pattern: $T
+    inside:
+      stopBy: end
+      all:
+        - follows:
+            stopBy: end
+            kind: local_declaration_statement
+            has:
+              kind: variable_declaration
+              has:
+                kind: variable_declarator
+                all:
+                  - has:
+                      kind: identifier
+                      field: name
+                      pattern: $T
+                  - has:
+                      kind: string_literal
+        - follows:
+            stopBy: end
+            kind: local_declaration_statement
+            has:
+              kind: variable_declaration
+              all:
+                - has:
+                    kind: identifier
+                    regex: "^NpgsqlConnectionStringBuilder$"
+                - has:
+                    kind: variable_declarator
+                    all:
+                      - has:
+                          kind: identifier
+                          field: name
+                          pattern: $K
+                      - has:
+                          kind: object_creation_expression
+                          all:
+                            - has:
+                                kind: identifier
+                            - has:
+                                kind: argument_list
+  (NpgsqlConnectionStringBuilder $VALUE).Password = "$PASSWORD":
+    kind: assignment_expression
+    all:
+      - has:
+          kind: member_access_expression
+          all:
+            - has:
+                kind: identifier
+                pattern: $INSTANCE
+                nthChild: 1
+            - has:
+                kind: identifier
+                nthChild: 2
+                regex: ^Password$
+      - has:
+          kind: string_literal
+          has:
+            kind: string_literal_content
+    inside:
+      stopBy: end
+      follows:
+        stopBy: end
+        kind: field_declaration
+        has:
+          kind: variable_declaration
+          all:
+            - has:
+                kind: identifier
+                regex: "^NpgsqlConnectionStringBuilder$"
+            - has:
+                kind: variable_declarator
+                all:
+                  - has:
+                      kind: identifier
+                      field: name
+                      pattern: $INSTANCE
+                  - has:
+                      kind: object_creation_expression
+                      all:
+                        - has:
+                            kind: identifier
+                        - has:
+                            kind: argument_list
+rule:
+  any:
+    - matches: match_NpgsqlConnectionStringBuilder_with_string
+    - matches: match_with_brackets
+    - matches: match_instance_with_braces
+    - matches: match_instance_without_braces
+    - matches: braces_instance
+    - matches: match_password_with_instance
+    - matches: (NpgsqlConnectionStringBuilder $VALUE).Password = "$PASSWORD"