Skip to content

Commit 3ea041e

Browse files
ESS-ENNESS-ENN
committed
secrets-reqwest-hardcoded-auth-rust
1 parent 5fa2d6f commit 3ea041e

File tree

3 files changed

+272
-0
lines changed

3 files changed

+272
-0
lines changed

‎rules/rust/security/secrets-reqwest-hardcoded-auth-rust.yml

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
id: secrets-reqwest-hardcoded-auth-rust
2+
language: rust
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. It is
8+
recommended to rotate the secret and retrieve them from a secure secret
9+
vault or Hardware Security Module (HSM), alternatively environment
10+
variables can be used if allowed by your company policy.
11+
note: >-
12+
[CWE-798] Use of Hard-coded Credentials.
13+
[REFERENCES]
14+
- https://docs.rs/reqwest/latest/reqwest/
15+
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
16+
utils:
17+
MATCH_PATTERN_ONE:
18+
kind: call_expression
19+
all:
20+
- has:
21+
stopBy: neighbor
22+
kind: field_expression
23+
all:
24+
- has:
25+
stopBy: neighbor
26+
kind: call_expression
27+
has:
28+
stopBy: neighbor
29+
kind: field_expression
30+
all:
31+
- has:
32+
stopBy: neighbor
33+
kind: identifier
34+
pattern: $C
35+
- has:
36+
stopBy: neighbor
37+
kind: field_identifier
38+
regex: "^bearer_auth|basic_auth$"
39+
- has:
40+
stopBy: neighbor
41+
kind: arguments
42+
all:
43+
- has:
44+
stopBy: neighbor
45+
kind: string_literal
46+
has:
47+
stopBy: neighbor
48+
kind: string_content
49+
- has:
50+
stopBy: neighbor
51+
kind: call_expression
52+
all:
53+
- has:
54+
stopBy: neighbor
55+
kind: identifier
56+
regex: "^Some$"
57+
- has:
58+
stopBy: neighbor
59+
kind: arguments
60+
has:
61+
stopBy: neighbor
62+
kind: string_literal
63+
has:
64+
stopBy: neighbor
65+
kind: string_content
66+
67+
- inside:
68+
stopBy: end
69+
kind: let_declaration
70+
follows:
71+
stopBy: end
72+
kind: let_declaration
73+
all:
74+
- has:
75+
stopBy: neighbor
76+
kind: identifier
77+
pattern: $C
78+
- has:
79+
stopBy: neighbor
80+
kind: call_expression
81+
pattern: reqwest::Client::new($$$)
82+
83+
MATCH_PATTERN_TWO:
84+
kind: call_expression
85+
all:
86+
- has:
87+
stopBy: neighbor
88+
kind: field_expression
89+
all:
90+
- has:
91+
stopBy: neighbor
92+
kind: call_expression
93+
has:
94+
stopBy: neighbor
95+
kind: field_expression
96+
all:
97+
- has:
98+
stopBy: neighbor
99+
kind: identifier
100+
pattern: $C
101+
- has:
102+
stopBy: neighbor
103+
kind: field_identifier
104+
regex: "^bearer_auth|basic_auth$"
105+
- inside:
106+
stopBy: end
107+
kind: let_declaration
108+
follows:
109+
stopBy: end
110+
kind: let_declaration
111+
all:
112+
- has:
113+
stopBy: neighbor
114+
kind: identifier
115+
pattern: $C
116+
- has:
117+
stopBy: neighbor
118+
kind: call_expression
119+
pattern: reqwest::Client::new($$$)
120+
- has:
121+
stopBy: neighbor
122+
kind: arguments
123+
all:
124+
- has:
125+
stopBy: neighbor
126+
kind: string_literal
127+
has:
128+
stopBy: neighbor
129+
kind: string_content
130+
- not:
131+
has:
132+
kind: call_expression
133+
134+
rule:
135+
kind: call_expression
136+
any:
137+
- matches: MATCH_PATTERN_ONE
138+
- matches: MATCH_PATTERN_TWO

‎tests/__snapshots__/secrets-reqwest-hardcoded-auth-rust-snapshot.yml

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
id: secrets-reqwest-hardcoded-auth-rust
2+
snapshots:
3+
? |
4+
async fn test1() -> Result<(), reqwest::Error> {
5+
let client = reqwest::Client::new();
6+
let resp = client.delete("http://httpbin.org/delete")
7+
.basic_auth("admin", Some("hardcoded-password"))
8+
.send()
9+
.await?;
10+
println!("body = {:?}", resp);
11+
Ok(())
12+
}
13+
async fn test2() -> Result<(), reqwest::Error> {
14+
let client = reqwest::Client::new();
15+
let resp = client.put("http://httpbin.org/delete")
16+
.bearer_auth("hardcoded-token")
17+
.send()
18+
.await?;
19+
println!("body = {:?}", resp);
20+
Ok(())
21+
}
22+
: labels:
23+
- source: |-
24+
client.delete("http://httpbin.org/delete")
25+
.basic_auth("admin", Some("hardcoded-password"))
26+
style: primary
27+
start: 97
28+
end: 188
29+
- source: client
30+
style: secondary
31+
start: 97
32+
end: 103
33+
- source: client.delete
34+
style: secondary
35+
start: 97
36+
end: 110
37+
- source: client.delete("http://httpbin.org/delete")
38+
style: secondary
39+
start: 97
40+
end: 139
41+
- source: basic_auth
42+
style: secondary
43+
start: 141
44+
end: 151
45+
- source: |-
46+
client.delete("http://httpbin.org/delete")
47+
.basic_auth
48+
style: secondary
49+
start: 97
50+
end: 151
51+
- source: admin
52+
style: secondary
53+
start: 153
54+
end: 158
55+
- source: '"admin"'
56+
style: secondary
57+
start: 152
58+
end: 159
59+
- source: Some
60+
style: secondary
61+
start: 161
62+
end: 165
63+
- source: hardcoded-password
64+
style: secondary
65+
start: 167
66+
end: 185
67+
- source: '"hardcoded-password"'
68+
style: secondary
69+
start: 166
70+
end: 186
71+
- source: ("hardcoded-password")
72+
style: secondary
73+
start: 165
74+
end: 187
75+
- source: Some("hardcoded-password")
76+
style: secondary
77+
start: 161
78+
end: 187
79+
- source: ("admin", Some("hardcoded-password"))
80+
style: secondary
81+
start: 151
82+
end: 188
83+
- source: client
84+
style: secondary
85+
start: 53
86+
end: 59
87+
- source: reqwest::Client::new()
88+
style: secondary
89+
start: 62
90+
end: 84
91+
- source: let client = reqwest::Client::new();
92+
style: secondary
93+
start: 49
94+
end: 85
95+
- source: |-
96+
let resp = client.delete("http://httpbin.org/delete")
97+
.basic_auth("admin", Some("hardcoded-password"))
98+
.send()
99+
.await?;
100+
style: secondary
101+
start: 86
102+
end: 205

‎tests/rust/secrets-reqwest-hardcoded-auth-rust-test.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: secrets-reqwest-hardcoded-auth-rust
2+
valid:
3+
- |
4+
async fn test1(pass: &str) -> Result<(), reqwest::Error> {
5+
let client = reqwest::Client::new();
6+
let resp = client.delete("http://httpbin.org/delete")
7+
.basic_auth("admin", Some(pass))
8+
.send()
9+
.await?;
10+
println!("body = {:?}", resp);
11+
Ok(())
12+
}
13+
invalid:
14+
- |
15+
async fn test1() -> Result<(), reqwest::Error> {
16+
let client = reqwest::Client::new();
17+
let resp = client.delete("http://httpbin.org/delete")
18+
.basic_auth("admin", Some("hardcoded-password"))
19+
.send()
20+
.await?;
21+
println!("body = {:?}", resp);
22+
Ok(())
23+
}
24+
async fn test2() -> Result<(), reqwest::Error> {
25+
let client = reqwest::Client::new();
26+
let resp = client.put("http://httpbin.org/delete")
27+
.bearer_auth("hardcoded-token")
28+
.send()
29+
.await?;
30+
println!("body = {:?}", resp);
31+
Ok(())
32+
}

0 commit comments

Comments
 (0)