Skip to content

Commit 07d272c

Browse files
ESS-ENNESS-ENN
committed
jedis-jedisfactory-hardcoded-password-java
1 parent a2ee520 commit 07d272c

3 files changed

+359
-0
lines changed

‎rules/java/security/jedis-jedisfactory-hardcoded-password-java.yml

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
id: jedis-jedisfactory-hardcoded-password-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
utils:
15+
MATCH_PATTERN_JEDISFACTORY:
16+
kind: expression_statement
17+
all:
18+
- has:
19+
stopBy: neighbor
20+
kind: method_invocation
21+
all:
22+
- has:
23+
stopBy: neighbor
24+
kind: identifier
25+
pattern: $R
26+
- has:
27+
stopBy: neighbor
28+
kind: identifier
29+
regex: "^setPassword$"
30+
- has:
31+
stopBy: neighbor
32+
kind: argument_list
33+
has:
34+
stopBy: neighbor
35+
kind: string_literal
36+
- follows:
37+
stopBy: end
38+
kind: local_variable_declaration
39+
all:
40+
- has:
41+
stopBy: neighbor
42+
kind: type_identifier
43+
regex: "^JedisFactory$|^jedis.ConnectionFactory$"
44+
- has:
45+
stopBy: neighbor
46+
kind: variable_declarator
47+
all:
48+
- has:
49+
stopBy: neighbor
50+
kind: identifier
51+
pattern: $R
52+
- has:
53+
stopBy: neighbor
54+
kind: object_creation_expression
55+
- inside:
56+
stopBy: end
57+
kind: class_declaration
58+
follows:
59+
stopBy: end
60+
kind: import_declaration
61+
has:
62+
stopBy: neighbor
63+
kind: scoped_identifier
64+
all:
65+
- has:
66+
stopBy: end
67+
kind: identifier
68+
regex: "^redis$"
69+
- has:
70+
stopBy: end
71+
kind: identifier
72+
regex: "^clients$"
73+
74+
MATCH_PATTERN_CLIENT_JEDIS.JEDISFACTORY:
75+
kind: expression_statement
76+
all:
77+
- has:
78+
stopBy: neighbor
79+
kind: method_invocation
80+
all:
81+
- has:
82+
stopBy: neighbor
83+
kind: identifier
84+
pattern: $R
85+
- has:
86+
stopBy: neighbor
87+
kind: identifier
88+
regex: "^setPassword$"
89+
- has:
90+
stopBy: neighbor
91+
kind: argument_list
92+
has:
93+
stopBy: neighbor
94+
kind: string_literal
95+
- follows:
96+
stopBy: end
97+
kind: local_variable_declaration
98+
all:
99+
- has:
100+
stopBy: neighbor
101+
kind: scoped_type_identifier
102+
all:
103+
- has:
104+
stopBy: neighbor
105+
kind: scoped_type_identifier
106+
all:
107+
- has:
108+
stopBy: neighbor
109+
kind: type_identifier
110+
regex: "^clients$"
111+
- has:
112+
stopBy: neighbor
113+
kind: type_identifier
114+
regex: "^jedis$"
115+
- has:
116+
stopBy: neighbor
117+
kind: type_identifier
118+
regex: "^JedisFactory$|^ConnectionFactory$"
119+
- has:
120+
stopBy: end
121+
kind: variable_declarator
122+
has:
123+
stopBy: neighbor
124+
kind: identifier
125+
pattern: $R
126+
- inside:
127+
stopBy: end
128+
kind: class_declaration
129+
follows:
130+
stopBy: end
131+
kind: import_declaration
132+
all:
133+
- has:
134+
stopBy: end
135+
kind: identifier
136+
regex: "^redis$"
137+
- has:
138+
stopBy: end
139+
kind: asterisk
140+
141+
MATCH_PATTERN_JEDIS.JEDISFACTORY:
142+
kind: expression_statement
143+
all:
144+
- has:
145+
stopBy: neighbor
146+
kind: method_invocation
147+
all:
148+
- has:
149+
stopBy: neighbor
150+
kind: identifier
151+
pattern: $R
152+
- has:
153+
stopBy: neighbor
154+
kind: identifier
155+
regex: "^setPassword$"
156+
- has:
157+
stopBy: neighbor
158+
kind: argument_list
159+
has:
160+
stopBy: neighbor
161+
kind: string_literal
162+
- follows:
163+
stopBy: end
164+
kind: local_variable_declaration
165+
all:
166+
- has:
167+
stopBy: neighbor
168+
kind: scoped_type_identifier
169+
all:
170+
- has:
171+
stopBy: neighbor
172+
kind: type_identifier
173+
regex: "^jedis$"
174+
- has:
175+
stopBy: neighbor
176+
kind: type_identifier
177+
regex: "^JedisFactory$|^ConnectionFactory$"
178+
- has:
179+
stopBy: neighbor
180+
kind: variable_declarator
181+
has:
182+
stopBy: neighbor
183+
kind: identifier
184+
pattern: $R
185+
186+
MATCH_PATTERN_REDIS_CLIENT_JEDIS.JEDISFACTORY:
187+
kind: expression_statement
188+
all:
189+
- has:
190+
stopBy: neighbor
191+
kind: method_invocation
192+
all:
193+
- has:
194+
stopBy: neighbor
195+
kind: identifier
196+
pattern: $R
197+
- has:
198+
stopBy: neighbor
199+
kind: identifier
200+
regex: "^setPassword$"
201+
- has:
202+
stopBy: neighbor
203+
kind: argument_list
204+
has:
205+
stopBy: neighbor
206+
kind: string_literal
207+
- follows:
208+
stopBy: end
209+
kind: local_variable_declaration
210+
all:
211+
- has:
212+
stopBy: neighbor
213+
kind: scoped_type_identifier
214+
all:
215+
- has:
216+
stopBy: neighbor
217+
kind: scoped_type_identifier
218+
all:
219+
- has:
220+
stopBy: end
221+
kind: type_identifier
222+
regex: "^redis$"
223+
- has:
224+
stopBy: end
225+
kind: type_identifier
226+
regex: "^clients$"
227+
- has:
228+
stopBy: end
229+
kind: type_identifier
230+
regex: "^jedis$"
231+
- has:
232+
stopBy: end
233+
kind: type_identifier
234+
regex: "^ConnectionFactory$|^JedisFactory$"
235+
- has:
236+
stopBy: neighbor
237+
kind: variable_declarator
238+
has:
239+
stopBy: end
240+
kind: identifier
241+
pattern: $R
242+
rule:
243+
kind: expression_statement
244+
any:
245+
- matches: MATCH_PATTERN_JEDISFACTORY
246+
- matches: MATCH_PATTERN_CLIENT_JEDIS.JEDISFACTORY
247+
- matches: MATCH_PATTERN_JEDIS.JEDISFACTORY
248+
- matches: MATCH_PATTERN_REDIS_CLIENT_JEDIS.JEDISFACTORY

‎tests/__snapshots__/jedis-jedisfactory-hardcoded-password-java-snapshot.yml

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
id: jedis-jedisfactory-hardcoded-password-java
2+
snapshots:
3+
? |
4+
import redis.clients.jedis.JedisFactory;
5+
6+
@Service
7+
public class JedisService implements IJedisService {
8+
@Test
9+
public void hardcoded() {
10+
JedisFactory jedisFactory = new JedisFactory();
11+
jedisFactory.setHostName(hostName);
12+
jedisFactory.setport(port);
13+
jedisFactory.setPassword("asdf");
14+
jedisFactory.setDatabase(database);
15+
}
16+
}
17+
: labels:
18+
- source: jedisFactory.setPassword("asdf");
19+
style: primary
20+
start: 248
21+
end: 281
22+
- source: jedisFactory
23+
style: secondary
24+
start: 248
25+
end: 260
26+
- source: setPassword
27+
style: secondary
28+
start: 261
29+
end: 272
30+
- source: '"asdf"'
31+
style: secondary
32+
start: 273
33+
end: 279
34+
- source: ("asdf")
35+
style: secondary
36+
start: 272
37+
end: 280
38+
- source: jedisFactory.setPassword("asdf")
39+
style: secondary
40+
start: 248
41+
end: 280
42+
- source: JedisFactory
43+
style: secondary
44+
start: 136
45+
end: 148
46+
- source: jedisFactory
47+
style: secondary
48+
start: 149
49+
end: 161
50+
- source: new JedisFactory()
51+
style: secondary
52+
start: 164
53+
end: 182
54+
- source: jedisFactory = new JedisFactory()
55+
style: secondary
56+
start: 149
57+
end: 182
58+
- source: JedisFactory jedisFactory = new JedisFactory();
59+
style: secondary
60+
start: 136
61+
end: 183
62+
- source: redis
63+
style: secondary
64+
start: 7
65+
end: 12
66+
- source: clients
67+
style: secondary
68+
start: 13
69+
end: 20
70+
- source: redis.clients.jedis.JedisFactory
71+
style: secondary
72+
start: 7
73+
end: 39
74+
- source: import redis.clients.jedis.JedisFactory;
75+
style: secondary
76+
start: 0
77+
end: 40
78+
- source: |-
79+
@Service
80+
public class JedisService implements IJedisService {
81+
@Test
82+
public void hardcoded() {
83+
JedisFactory jedisFactory = new JedisFactory();
84+
jedisFactory.setHostName(hostName);
85+
jedisFactory.setport(port);
86+
jedisFactory.setPassword("asdf");
87+
jedisFactory.setDatabase(database);
88+
}
89+
}
90+
style: secondary
91+
start: 42
92+
end: 321

‎tests/java/jedis-jedisfactory-hardcoded-password-java-test.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: jedis-jedisfactory-hardcoded-password-java
2+
valid:
3+
- |
4+
jedisFactory.setPassword(password);
5+
invalid:
6+
- |
7+
import redis.clients.jedis.JedisFactory;
8+
9+
@Service
10+
public class JedisService implements IJedisService {
11+
@Test
12+
public void hardcoded() {
13+
JedisFactory jedisFactory = new JedisFactory();
14+
jedisFactory.setHostName(hostName);
15+
jedisFactory.setport(port);
16+
jedisFactory.setPassword("asdf");
17+
jedisFactory.setDatabase(database);
18+
}
19+
}

0 commit comments

Comments
 (0)