Add security rules for detecting hard-coded secrets and empty passwords #79
Conversation
WalkthroughThis pull request introduces three new security rules for Rust applications, targeting the detection of hard-coded secrets and empty passwords in the Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Outside diff range and nitpick comments (9)
tests/rust/secrets-reqwest-hardcoded-auth-rust-test.yml (1)
2-43: Enhance test coverage with additional scenariosConsider adding test cases for:
- Environment variable based authentication
- Secret manager integration
- Empty/null credentials
- Special characters in credentials
- Token-based authentication with dynamic token generation
Would you like me to help generate additional test cases?
🧰 Tools
🪛 yamllint (1.35.1)
[error] 22-22: trailing spaces
(trailing-spaces)
rules/rust/security/secrets-reqwest-hardcoded-auth-rust.yml (3)
4-10: Enhance security message with specific remediation stepsThe current message could be more actionable. Consider adding:
- Examples of secure credential management patterns
- Links to recommended secret vaults/HSM solutions
- Code examples showing correct implementation
Would you like me to help draft an enhanced message?
17-83: Extend pattern matching for additional security scenariosConsider adding patterns to detect:
- Empty or default credentials
- Common password patterns
- Base64 encoded secrets
- Environment variable presence checks
Would you like me to help define additional patterns?
Also applies to: 84-135
🧰 Tools
🪛 yamllint (1.35.1)
[warning] 44-44: wrong indentation: expected 16 but found 15
(indentation)
[warning] 47-47: wrong indentation: expected 17 but found 16
(indentation)
[error] 66-66: trailing spaces
(trailing-spaces)
[error] 67-67: trailing spaces
(trailing-spaces)
1-142: Fix YAML formatting issuesSeveral formatting issues need to be addressed:
- Incorrect indentation at lines 44, 47, 132, 137
- Trailing spaces at lines 66, 67, 134
- Extra blank lines at the end
Apply this diff to fix the formatting:
@@ -41,7 +41,7 @@ kind: arguments all: - has: - stopBy: neighbor + stopBy: neighbor kind: string_literal has: - stopBy: neighbor + stopBy: neighbor kind: string_content @@ -63,8 +63,7 @@ has: stopBy: neighbor kind: string_content - - + - inside: stopBy: end kind: let_declaration @@ -130,15 +129,12 @@ kind: string_content - not: has: - kind: call_expression - - + kind: call_expression rule: - kind: call_expression - any: - - matches: MATCH_PATTERN_ONE - - matches: MATCH_PATTERN_TWO - - + kind: call_expression + any: + - matches: MATCH_PATTERN_ONE + - matches: MATCH_PATTERN_TWO🧰 Tools
🪛 yamllint (1.35.1)
[warning] 44-44: wrong indentation: expected 16 but found 15
(indentation)
[warning] 47-47: wrong indentation: expected 17 but found 16
(indentation)
[error] 66-66: trailing spaces
(trailing-spaces)
[error] 67-67: trailing spaces
(trailing-spaces)
[warning] 132-132: wrong indentation: expected 16 but found 15
(indentation)
[error] 134-134: trailing spaces
(trailing-spaces)
[warning] 137-137: wrong indentation: expected 2 but found 1
(indentation)
[warning] 142-142: too many blank lines
(2 > 0) (empty-lines)
tests/rust/tokio-postgres-hardcoded-password-rust-test.yml (1)
39-48: Add test case description and improve variable namingThe test case would benefit from a description comment and more descriptive variable names.
Consider adding a descriptive comment:
+// Test case: Direct hardcoded password in config fn test1() { let mut config = postgres::Config::new(); configrules/rust/security/tokio-postgres-hardcoded-password-rust.yml (2)
4-15: Enhance documentation with examplesThe rule documentation would benefit from concrete examples of both compliant and non-compliant code.
Consider adding examples in the documentation:
note: >- [CWE-798] Use of Hard-coded Credentials. [REFERENCES] - https://docs.rs/tokio-postgres/latest/tokio_postgres/ - - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + [EXAMPLES] + Non-compliant: + config.password("hardcoded-secret") + Compliant: + config.password(std::env::var("DB_PASSWORD").expect("DB_PASSWORD not set"))
281-287: Fix formatting and add pattern descriptionsThe rule section would benefit from descriptions for each pattern and consistent formatting.
Add pattern descriptions and fix formatting:
rule: kind: call_expression any: - - matches: MATCH_PATTERN_WITH_INSTANCE - - matches: MATCH_PASSWORD_DIRECTLY - - matches: MATCH_PATTERN_PASSWORD_WITH_ITS_INSTANCE - - matches: MATCH_PATTERN_WITH_INSTANCE_&_PASSWORD_WITH_ITS_INSTANCE + - matches: MATCH_PATTERN_WITH_INSTANCE # Matches direct config instance usage + - matches: MATCH_PASSWORD_DIRECTLY # Matches inline password setting + - matches: MATCH_PATTERN_PASSWORD_WITH_ITS_INSTANCE # Matches variable assignment + - matches: MATCH_PATTERN_WITH_INSTANCE_&_PASSWORD_WITH_ITS_INSTANCE # Matches combined patterns +🧰 Tools
🪛 yamllint (1.35.1)
[error] 287-287: no new line character at the end of file
(new-line-at-end-of-file)
tests/__snapshots__/tokio-postgres-empty-password-rust-snapshot.yml (2)
13-17: Reduce code duplication in error handling.The error handling logic for the PostgreSQL connection is duplicated across test functions. Consider extracting it into a helper function.
+async fn handle_connection_error(connection: tokio_postgres::Connection) { + if let Err(e) = connection.await { + tracing::error!("postgres db connection error: {}", e); + } +} async fn test1() -> Result<(), anyhow::Error> { // ... existing code ... - tokio::spawn(async move { - if let Err(e) = connection.await { - tracing::error!("postgres db connection error: {}", e); - } - }); + tokio::spawn(handle_connection_error(connection)); Ok(()) }Also applies to: 265-269
261-264: Improve error handling consistency.test2() uses a different error handling approach with custom error mapping. Consider standardizing the error handling approach across all test functions.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (9)
rules/rust/security/secrets-reqwest-hardcoded-auth-rust.yml(1 hunks)rules/rust/security/tokio-postgres-empty-password-rust.yml(1 hunks)rules/rust/security/tokio-postgres-hardcoded-password-rust.yml(1 hunks)tests/__snapshots__/secrets-reqwest-hardcoded-auth-rust-snapshot.yml(1 hunks)tests/__snapshots__/tokio-postgres-empty-password-rust-snapshot.yml(1 hunks)tests/__snapshots__/tokio-postgres-hardcoded-password-rust-snapshot.yml(1 hunks)tests/rust/secrets-reqwest-hardcoded-auth-rust-test.yml(1 hunks)tests/rust/tokio-postgres-empty-password-rust-test.yml(1 hunks)tests/rust/tokio-postgres-hardcoded-password-rust-test.yml(1 hunks)
🧰 Additional context used
🪛 yamllint (1.35.1)
tests/rust/tokio-postgres-empty-password-rust-test.yml
[error] 79-79: no new line character at the end of file
(new-line-at-end-of-file)
rules/rust/security/secrets-reqwest-hardcoded-auth-rust.yml
[warning] 44-44: wrong indentation: expected 16 but found 15
(indentation)
[warning] 47-47: wrong indentation: expected 17 but found 16
(indentation)
[error] 66-66: trailing spaces
(trailing-spaces)
[error] 67-67: trailing spaces
(trailing-spaces)
[warning] 132-132: wrong indentation: expected 16 but found 15
(indentation)
[error] 134-134: trailing spaces
(trailing-spaces)
[warning] 137-137: wrong indentation: expected 2 but found 1
(indentation)
[warning] 142-142: too many blank lines
(2 > 0) (empty-lines)
tests/rust/tokio-postgres-hardcoded-password-rust-test.yml
[error] 59-59: no new line character at the end of file
(new-line-at-end-of-file)
tests/rust/secrets-reqwest-hardcoded-auth-rust-test.yml
[error] 22-22: trailing spaces
(trailing-spaces)
rules/rust/security/tokio-postgres-hardcoded-password-rust.yml
[warning] 25-25: wrong indentation: expected 16 but found 18
(indentation)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 130-130: trailing spaces
(trailing-spaces)
[error] 182-182: trailing spaces
(trailing-spaces)
[error] 197-197: trailing spaces
(trailing-spaces)
[warning] 206-206: wrong indentation: expected 16 but found 18
(indentation)
[error] 248-248: trailing spaces
(trailing-spaces)
[warning] 271-271: wrong indentation: expected 20 but found 19
(indentation)
[error] 287-287: no new line character at the end of file
(new-line-at-end-of-file)
rules/rust/security/tokio-postgres-empty-password-rust.yml
[warning] 24-24: wrong indentation: expected 16 but found 18
(indentation)
[warning] 63-63: wrong indentation: expected 14 but found 13
(indentation)
[warning] 64-64: wrong indentation: expected 15 but found 14
(indentation)
[error] 69-69: trailing spaces
(trailing-spaces)
[warning] 128-128: wrong indentation: expected 14 but found 13
(indentation)
[warning] 129-129: wrong indentation: expected 15 but found 14
(indentation)
[error] 131-131: trailing spaces
(trailing-spaces)
[error] 183-183: trailing spaces
(trailing-spaces)
[warning] 196-196: wrong indentation: expected 22 but found 21
(indentation)
[warning] 197-197: wrong indentation: expected 23 but found 22
(indentation)
[error] 199-199: trailing spaces
(trailing-spaces)
[warning] 208-208: wrong indentation: expected 16 but found 18
(indentation)
[error] 250-250: trailing spaces
(trailing-spaces)
[warning] 273-273: wrong indentation: expected 20 but found 19
(indentation)
[warning] 281-281: wrong indentation: expected 24 but found 23
(indentation)
[warning] 285-285: wrong indentation: expected 2 but found 3
(indentation)
[warning] 287-287: wrong indentation: expected 5 but found 4
(indentation)
[error] 290-290: no new line character at the end of file
(new-line-at-end-of-file)
🔇 Additional comments (1)
rules/rust/security/tokio-postgres-empty-password-rust.yml (1)
1-14: Well-structured security rule with comprehensive documentation.
The rule is well-defined with:
- Clear message explaining the security implications
- Appropriate severity level
- Relevant references to CWE-287 and OWASP guidelines
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (2)
rules/rust/security/tokio-postgres-hardcoded-password-rust.yml (2)
4-16: Enhance security guidance in the message and referencesThe message and references are good but could be strengthened:
- Add a cautionary note about environment variables not being completely secure
- Include references to secure secret management solutions
message: >- A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment - variables can be used if allowed by your company policy. + variables can be used if allowed by your company policy, but note that + they can still be exposed through process inspection or environment dumps. note: >- [CWE-798] Use of Hard-coded Credentials. [REFERENCES] - https://docs.rs/tokio-postgres/latest/tokio_postgres/ - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures + - https://www.vaultproject.io/ + - https://aws.amazon.com/secrets-manager/
282-288: Improve rule definition and fix file format
- Consider ordering patterns by specificity (most specific first)
- Add newline at end of file
rule: kind: call_expression any: - - matches: MATCH_PATTERN_WITH_INSTANCE - matches: MATCH_PASSWORD_DIRECTLY + - matches: MATCH_EMPTY_PASSWORD # Add new pattern + - matches: MATCH_CONNECTION_URL # Add new pattern + - matches: MATCH_PATTERN_WITH_INSTANCE - matches: MATCH_PATTERN_PASSWORD_WITH_ITS_INSTANCE - matches: MATCH_PATTERN_WITH_INSTANCE_&_PASSWORD_WITH_ITS_INSTANCE +🧰 Tools
🪛 yamllint (1.35.1)
[error] 288-288: no new line character at the end of file
(new-line-at-end-of-file)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
rules/rust/security/tokio-postgres-hardcoded-password-rust.yml(1 hunks)
🧰 Additional context used
🪛 yamllint (1.35.1)
rules/rust/security/tokio-postgres-hardcoded-password-rust.yml
[warning] 26-26: wrong indentation: expected 16 but found 18
(indentation)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 131-131: trailing spaces
(trailing-spaces)
[error] 183-183: trailing spaces
(trailing-spaces)
[error] 198-198: trailing spaces
(trailing-spaces)
[warning] 207-207: wrong indentation: expected 16 but found 18
(indentation)
[error] 249-249: trailing spaces
(trailing-spaces)
[warning] 272-272: wrong indentation: expected 20 but found 19
(indentation)
[error] 288-288: no new line character at the end of file
(new-line-at-end-of-file)
🔇 Additional comments (1)
rules/rust/security/tokio-postgres-hardcoded-password-rust.yml (1)
1-288: Verify rule coverage against common patterns
Let's verify if the rule catches all common patterns of password usage in the codebase.
✅ Verification successful
Rule effectively covers all common hardcoded password patterns
Based on the test cases and snapshots examined, the rule successfully detects all common patterns of hardcoded password usage in tokio-postgres configurations:
- Direct string literals in password method:
.password("hardcoded-password") - Variable assignments with hardcoded values:
pwd = "secret"; .password(pwd) - Both
postgres::Configandtokio_postgres::Configvariants - Chained configuration methods in different orders
- Various connection setup patterns (single config vs direct chain)
The test cases provide good coverage of real-world usage patterns, and the rule's AST patterns effectively match these scenarios. The complementary empty-password rule ensures comprehensive coverage of credential-related security issues.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check for common password patterns in Rust files
# Search for tokio-postgres usage patterns
echo "Checking for tokio-postgres usage patterns..."
rg -t rust 'postgres::Config::new\(\)' -A 5
# Search for potential password assignments
echo "Checking for password assignments..."
rg -t rust '\.password\(' -A 2
# Search for connection strings
echo "Checking for connection strings..."
rg -t rust 'postgres://' -A 1
Length of output: 818
Script:
#!/bin/bash
# Let's try a different approach to find Rust files and patterns
# First, find all Rust files
echo "Finding Rust files..."
fd -e rs
# Look for any postgres related imports or usage
echo "Checking for postgres usage..."
rg "postgres" -l
# Look for test files that might contain examples
echo "Checking test files..."
fd -e rs "test"
# Look for example files
echo "Checking example files..."
fd "example" -e rs
Length of output: 678
Script:
#!/bin/bash
# Let's examine the test files to verify rule coverage
# Check the test snapshots
echo "Checking test snapshots for coverage patterns..."
cat tests/__snapshots__/tokio-postgres-hardcoded-password-rust-snapshot.yml
# Check the test cases
echo -e "\nChecking test cases..."
cat tests/rust/tokio-postgres-hardcoded-password-rust-test.yml
# Check the related empty password rule
echo -e "\nChecking related empty password rule..."
cat rules/rust/security/tokio-postgres-empty-password-rust.yml
Length of output: 22732
🧰 Tools
🪛 yamllint (1.35.1)
[warning] 26-26: wrong indentation: expected 16 but found 18
(indentation)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 131-131: trailing spaces
(trailing-spaces)
[error] 183-183: trailing spaces
(trailing-spaces)
[error] 198-198: trailing spaces
(trailing-spaces)
[warning] 207-207: wrong indentation: expected 16 but found 18
(indentation)
[error] 249-249: trailing spaces
(trailing-spaces)
[warning] 272-272: wrong indentation: expected 20 but found 19
(indentation)
[error] 288-288: no new line character at the end of file
(new-line-at-end-of-file)
| stopby: end | ||
| kind: expression_statement | ||
| has: | ||
| stopBy: end | ||
| kind: assignment_expression | ||
| all: | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: identifier | ||
| pattern: $E | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: string_literal | ||
| has: | ||
| stopBy: neighbor | ||
| kind: string_content | ||
|
|
||
| MATCH_PATTERN_WITH_INSTANCE_&_PASSWORD_WITH_ITS_INSTANCE: | ||
| kind: call_expression | ||
| all: | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: field_expression | ||
| all: | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: call_expression | ||
| all: | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: field_expression | ||
| all: | ||
| - has: | ||
| stopBy: end | ||
| kind: call_expression | ||
| all: | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: field_expression | ||
| all: | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: identifier | ||
| pattern: $C | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: arguments | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: field_identifier | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: arguments | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: field_identifier | ||
| regex: "^password$" | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: arguments | ||
| has: | ||
| stopBy: neighbor | ||
| kind: identifier | ||
| pattern: $Z | ||
| - inside: | ||
| stopBy: end | ||
| kind: expression_statement | ||
| follows: | ||
| stopBy: end | ||
| kind: let_declaration | ||
| all: | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: identifier | ||
| pattern: $C | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: call_expression | ||
| pattern: postgres::Config::new() | ||
| - inside: | ||
| stopBy: end | ||
| kind: block | ||
| has: | ||
| stopBy: end | ||
| kind: expression_statement | ||
| has: | ||
| stopBy: neighbor | ||
| kind: assignment_expression | ||
| all: | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: identifier | ||
| pattern: $Z | ||
| - has: | ||
| stopBy: neighbor | ||
| kind: string_literal | ||
| has: | ||
| stopBy: neighbor | ||
| kind: string_content | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add patterns for additional security scenarios
The current patterns might miss some security-sensitive cases:
- Empty passwords
- Connection string URLs containing credentials
- String concatenation in password assignments
Add these additional patterns:
MATCH_EMPTY_PASSWORD:
kind: call_expression
all:
- has:
kind: field_expression
all:
- has:
kind: field_identifier
regex: '^password$'
- has:
kind: arguments
has:
kind: string_literal
has:
kind: string_content
pattern: '^$'
MATCH_CONNECTION_URL:
kind: call_expression
all:
- has:
kind: arguments
has:
kind: string_literal
regex: 'postgres://.+:.+@.+'🧰 Tools
🪛 yamllint (1.35.1)
[warning] 26-26: wrong indentation: expected 16 but found 18
(indentation)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 131-131: trailing spaces
(trailing-spaces)
[error] 183-183: trailing spaces
(trailing-spaces)
[error] 198-198: trailing spaces
(trailing-spaces)
[warning] 207-207: wrong indentation: expected 16 but found 18
(indentation)
[error] 249-249: trailing spaces
(trailing-spaces)
[warning] 272-272: wrong indentation: expected 20 but found 19
(indentation)
Fix YAML formatting issues and improve pattern names
The utility patterns have formatting issues that could affect parsing:
- Inconsistent indentation at lines 26, 207, and 272
- Trailing spaces at lines 70, 131, 183, 198, and 249
Apply these fixes:
- Fix indentation to be consistent (2 spaces per level)
- Remove all trailing spaces
- Add more descriptive pattern names
utils:
MATCH_PATTERN_WITH_INSTANCE:
- # Current implementation...
+ MATCH_CONFIG_INSTANCE_WITH_HARDCODED_PASSWORD:
# Rest of implementation with fixed indentation...Also consider consolidating redundant checks in the patterns to improve maintainability.
Committable suggestion skipped: line range outside the PR's diff.
🧰 Tools
🪛 yamllint (1.35.1)
[warning] 26-26: wrong indentation: expected 16 but found 18
(indentation)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 131-131: trailing spaces
(trailing-spaces)
[error] 183-183: trailing spaces
(trailing-spaces)
[error] 198-198: trailing spaces
(trailing-spaces)
[warning] 207-207: wrong indentation: expected 16 but found 18
(indentation)
[error] 249-249: trailing spaces
(trailing-spaces)
[warning] 272-272: wrong indentation: expected 20 but found 19
(indentation)
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Outside diff range and nitpick comments (2)
rules/rust/security/tokio-postgres-hardcoded-password-rust.yml (2)
4-16: Enhance security guidance in the messageConsider enhancing the message with:
- Specific examples of secure alternatives (e.g., AWS Secrets Manager, HashiCorp Vault)
- Best practices for credential rotation (e.g., automatic rotation schedules)
message: >- A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret - vault or Hardware Security Module (HSM), alternatively environment - variables can be used if allowed by your company policy. + vault (e.g., AWS Secrets Manager, HashiCorp Vault) or Hardware Security Module (HSM). + Environment variables can be used if allowed by your company policy. + Implement automatic credential rotation with defined schedules (e.g., every 90 days) + and ensure proper secret versioning and access controls are in place.
26-26: Fix YAML formatting issuesThe file has several formatting issues that should be fixed:
- Inconsistent indentation at lines 26, 207, and 272
- Trailing spaces at lines 70, 131, 183, 198, and 249
Also applies to: 70-70, 131-131, 183-183, 198-198, 207-207, 249-249, 272-272
🧰 Tools
🪛 yamllint (1.35.1)
[warning] 26-26: wrong indentation: expected 16 but found 18
(indentation)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
rules/rust/security/tokio-postgres-hardcoded-password-rust.yml(1 hunks)
🧰 Additional context used
🪛 yamllint (1.35.1)
rules/rust/security/tokio-postgres-hardcoded-password-rust.yml
[warning] 26-26: wrong indentation: expected 16 but found 18
(indentation)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 131-131: trailing spaces
(trailing-spaces)
[error] 183-183: trailing spaces
(trailing-spaces)
[error] 198-198: trailing spaces
(trailing-spaces)
[warning] 207-207: wrong indentation: expected 16 but found 18
(indentation)
[error] 249-249: trailing spaces
(trailing-spaces)
[warning] 272-272: wrong indentation: expected 20 but found 19
(indentation)
🔇 Additional comments (3)
rules/rust/security/tokio-postgres-hardcoded-password-rust.yml (3)
282-288: LGTM! Rule definition is well-structured
The main rule effectively combines all utility patterns to create a comprehensive detection mechanism.
17-281: 🛠️ Refactor suggestion
Add patterns for additional security scenarios
The current patterns might miss some security-sensitive cases:
- Empty passwords
- Connection string URLs containing credentials
- String concatenation in password assignments
Add these additional patterns as suggested in the past review comments.
🧰 Tools
🪛 yamllint (1.35.1)
[warning] 26-26: wrong indentation: expected 16 but found 18
(indentation)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 131-131: trailing spaces
(trailing-spaces)
[error] 183-183: trailing spaces
(trailing-spaces)
[error] 198-198: trailing spaces
(trailing-spaces)
[warning] 207-207: wrong indentation: expected 16 but found 18
(indentation)
[error] 249-249: trailing spaces
(trailing-spaces)
[warning] 272-272: wrong indentation: expected 20 but found 19
(indentation)
1-288: Verify test coverage and similar rules
Let's verify:
- Test coverage for these security rules
- Similar rules for other database frameworks
✅ Verification successful
Security rules are well-tested and properly structured
Based on the verification results:
-
Test coverage is comprehensive:
- Found test files in
tests/rust/tokio-postgres-hardcoded-password-rust-test.yml - Found test snapshots in
tests/__snapshots__/tokio-postgres-empty-password-rust-snapshot.yml - Tests cover various scenarios including environment variables, empty passwords, and hardcoded passwords
- Found test files in
-
Similar rules exist:
- Found complementary rule
tokio-postgres-empty-password-rust.ymlthat checks for empty passwords - Both rules work together to catch different types of password-related security issues
- Found complementary rule
-
Usage patterns in tests demonstrate:
- Correct pattern matching for
tokio_postgres::Config::new() - Various password configurations including environment variables (secure) and hardcoded strings (insecure)
- Proper test coverage for both positive and negative cases
- Correct pattern matching for
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check for test coverage and similar rules
# Check for test files
echo "Checking for test files..."
fd -e yml "test.*tokio-postgres-hardcoded-password" rules/
# Check for similar rules in other frameworks
echo "Checking for similar rules..."
fd -e yml . rules/rust/security/ -x grep -l "hardcoded.*password"
# Check for usage patterns
echo "Checking for usage patterns..."
rg "tokio_postgres::Config::new\(\)" -A 5
Length of output: 21923
🧰 Tools
🪛 yamllint (1.35.1)
[warning] 26-26: wrong indentation: expected 16 but found 18
(indentation)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 131-131: trailing spaces
(trailing-spaces)
[error] 183-183: trailing spaces
(trailing-spaces)
[error] 198-198: trailing spaces
(trailing-spaces)
[warning] 207-207: wrong indentation: expected 16 but found 18
(indentation)
[error] 249-249: trailing spaces
(trailing-spaces)
[warning] 272-272: wrong indentation: expected 20 but found 19
(indentation)
| - has: | ||
| stopBy: neighbor | ||
| kind: call_expression | ||
| pattern: tokio_tokio_postgres::Config::new() |
There was a problem hiding this comment.
Fix typo in pattern
The pattern has a typo in the package name:
- pattern: tokio_tokio_postgres::Config::new()
+ pattern: tokio_postgres::Config::new()📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| pattern: tokio_tokio_postgres::Config::new() | |
| pattern: tokio_postgres::Config::new() |
Summary by CodeRabbit
Release Notes
New Features
reqwestandtokio-postgreslibraries.Tests