Skip to content

Commit 55859ed

Browse files
ESS-ENNESS-ENN
authored
New Rules #2 (#9)
* express-session-hardcoded-secret-javascript * express-session-hardcoded-secret-typescript
1 parent 1cb4625 commit 55859ed

6 files changed

+710
-0
lines changed

‎rules/javascript/security/express-session-hardcoded-secret-javascript.yml

+256
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
id: express-session-hardcoded-secret-javascript
2+
language: javascript
3+
severity: warning
4+
message: >-
5+
A hard-coded credential was detected. It is not recommended to store
6+
credentials in source-code, as this risks secrets being leaked and used by
7+
either an internal or external malicious adversary. It is recommended to
8+
use environment variables to securely provide credentials or retrieve
9+
credentials from a secure vault or HSM (Hardware Security Module).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
utils:
15+
MATCH_SECRET:
16+
kind: pair
17+
pattern: $C
18+
inside:
19+
stopBy: end
20+
kind: lexical_declaration
21+
all:
22+
- has:
23+
stopBy: end
24+
kind: variable_declarator
25+
has:
26+
stopBy: end
27+
kind: object
28+
has:
29+
stopBy: end
30+
kind: pair
31+
pattern: $C
32+
all:
33+
- has:
34+
stopBy: end
35+
kind: property_identifier
36+
pattern: $S
37+
- has:
38+
stopBy: end
39+
kind: string
40+
has:
41+
stopBy: end
42+
kind: string_fragment
43+
44+
- any:
45+
- follows:
46+
stopBy: end
47+
kind: import_statement
48+
all:
49+
- has:
50+
stopBy: end
51+
kind: import_clause
52+
has:
53+
stopBy: neighbor
54+
kind: identifier
55+
pattern: $T
56+
- has:
57+
stopBy: neighbor
58+
kind: string
59+
has:
60+
stopBy: neighbor
61+
kind: string_fragment
62+
regex: "^express-session$"
63+
64+
- follows:
65+
stopBy: end
66+
kind: expression_statement
67+
has:
68+
stopBy: end
69+
kind: assignment_expression
70+
has:
71+
stopBy: end
72+
kind: call_expression
73+
all:
74+
- has:
75+
stopBy: neighbor
76+
kind: identifier
77+
regex: "^require$"
78+
- has:
79+
stopBy: end
80+
kind: arguments
81+
has:
82+
stopBy: neighbor
83+
kind: string
84+
has:
85+
stopBy: neighbor
86+
kind: string_fragment
87+
regex: "^express-session$"
88+
89+
- follows:
90+
stopBy: end
91+
kind: import_statement
92+
all:
93+
- has:
94+
stopBy: neighbor
95+
kind: import_clause
96+
has:
97+
stopBy: neighbor
98+
kind: namespace_import
99+
has:
100+
stopBy: neighbor
101+
kind: identifier
102+
pattern: $T
103+
- has:
104+
stopBy: neighbor
105+
kind: string
106+
has:
107+
stopBy: neighbor
108+
kind: string_fragment
109+
regex: "^express-session$"
110+
111+
MATCH_SECRET_INSIDE_APP:
112+
kind: pair
113+
pattern: $C
114+
inside:
115+
stopBy: end
116+
kind: expression_statement
117+
all:
118+
- has:
119+
stopBy: end
120+
kind: call_expression
121+
all:
122+
- has:
123+
stopBy: end
124+
kind: member_expression
125+
all:
126+
- has:
127+
stopBy: end
128+
kind: identifier
129+
- has:
130+
stopBy: end
131+
kind: property_identifier
132+
regex: "^use$"
133+
- has:
134+
stopBy: end
135+
kind: arguments
136+
has:
137+
stopBy: end
138+
kind: call_expression
139+
all:
140+
- has:
141+
stopBy: end
142+
kind: identifier
143+
pattern: $T
144+
- has:
145+
stopBy: end
146+
kind: object
147+
has:
148+
stopBy: end
149+
kind: pair
150+
pattern: $C
151+
all:
152+
- has:
153+
stopBy: end
154+
kind: property_identifier
155+
pattern: $S
156+
- any:
157+
- has:
158+
stopBy: neighbor
159+
kind: identifier
160+
- has:
161+
stopBy: neighbor
162+
kind: string
163+
164+
- any:
165+
- follows:
166+
stopBy: end
167+
kind: import_statement
168+
all:
169+
- has:
170+
stopBy: end
171+
kind: import_clause
172+
has:
173+
stopBy: neighbor
174+
kind: identifier
175+
pattern: $T
176+
- has:
177+
stopBy: neighbor
178+
kind: string
179+
has:
180+
stopBy: neighbor
181+
kind: string_fragment
182+
regex: "^express-session$"
183+
184+
- follows:
185+
stopBy: end
186+
kind: expression_statement
187+
has:
188+
stopBy: end
189+
kind: assignment_expression
190+
has:
191+
stopBy: end
192+
kind: call_expression
193+
all:
194+
- has:
195+
stopBy: neighbor
196+
kind: identifier
197+
regex: "^require$"
198+
- has:
199+
stopBy: end
200+
kind: arguments
201+
has:
202+
stopBy: neighbor
203+
kind: string
204+
has:
205+
stopBy: neighbor
206+
kind: string_fragment
207+
regex: "^express-session$"
208+
209+
- follows:
210+
stopBy: end
211+
kind: import_statement
212+
has:
213+
stopBy: end
214+
kind: import_clause
215+
all:
216+
- has:
217+
stopBy: end
218+
kind: named_imports
219+
has:
220+
stopBy: end
221+
kind: import_specifier
222+
has:
223+
stopBy: end
224+
kind: identifier
225+
pattern: $T
226+
227+
- follows:
228+
stopBy: end
229+
kind: import_statement
230+
all:
231+
- has:
232+
stopBy: neighbor
233+
kind: import_clause
234+
has:
235+
stopBy: neighbor
236+
kind: namespace_import
237+
has:
238+
stopBy: neighbor
239+
kind: identifier
240+
pattern: $T
241+
- has:
242+
stopBy: neighbor
243+
kind: string
244+
has:
245+
stopBy: neighbor
246+
kind: string_fragment
247+
regex: "^express-session$"
248+
rule:
249+
kind: pair
250+
any:
251+
- matches: MATCH_SECRET
252+
- matches: MATCH_SECRET_INSIDE_APP
253+
254+
constraints:
255+
S:
256+
regex: "^secret$"

0 commit comments

Comments
 (0)