python-webrepl-hardcoded-secret-python

Author: ESS-ENN

rules/python/security/python-webrepl-hardcoded-secret-python.yml

@@ -0,0 +1,54 @@
+id: python-webrepl-hardcoded-secret-python
+language: python
+severity: warning
+message: >-
+  A secret is hard-coded in the application. Secrets stored in source
+  code, such as credentials, identifiers, and other types of sensitive data,
+  can be leaked and used by internal or external malicious actors. Use
+  environment variables to securely provide credentials and other secrets or
+  retrieve them from a secure vault or Hardware Security Module (HSM).
+note: >-
+  [CWE-798]: Use of Hard-coded Credentials
+  [OWASP A07:2021]: Identification and Authentication Failures
+  [REFERENCES]
+       https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+
+ast-grep-essentials: true
+
+utils:
+  webrepl.start(..., password="",...):
+   kind: call
+   all:
+     - has:
+         stopBy: neighbor
+         kind: attribute
+         regex: ^webrepl.start$
+     - has:
+         stopBy: neighbor
+         kind: argument_list
+         has:
+           stopBy: neighbor
+           kind: keyword_argument
+           all:
+            - has:
+                stopBy: neighbor
+                kind: identifier
+                regex: ^password$
+            - has:
+                stopBy: neighbor
+                kind: string
+                has:
+                  stopBy: end
+                  kind: string_content
+rule:
+  kind: call
+  matches: webrepl.start(..., password="",...)
+  not:
+    all:
+      - has:
+          stopBy: end
+          kind: ERROR
+      - inside:
+          stopBy: end
+          kind: ERROR
+

tests/__snapshots__/python-webrepl-hardcoded-secret-python-snapshot.yml

@@ -0,0 +1,64 @@
+id: python-webrepl-hardcoded-secret-python
+snapshots:
+  ? |
+    webrepl.start(password="12345")
+  : labels:
+    - source: webrepl.start(password="12345")
+      style: primary
+      start: 0
+      end: 31
+    - source: webrepl.start
+      style: secondary
+      start: 0
+      end: 13
+    - source: password
+      style: secondary
+      start: 14
+      end: 22
+    - source: '12345'
+      style: secondary
+      start: 24
+      end: 29
+    - source: '"12345"'
+      style: secondary
+      start: 23
+      end: 30
+    - source: password="12345"
+      style: secondary
+      start: 14
+      end: 30
+    - source: (password="12345")
+      style: secondary
+      start: 13
+      end: 31
+  ? |
+    webrepl.start(password="mypassword")
+  : labels:
+    - source: webrepl.start(password="mypassword")
+      style: primary
+      start: 0
+      end: 36
+    - source: webrepl.start
+      style: secondary
+      start: 0
+      end: 13
+    - source: password
+      style: secondary
+      start: 14
+      end: 22
+    - source: mypassword
+      style: secondary
+      start: 24
+      end: 34
+    - source: '"mypassword"'
+      style: secondary
+      start: 23
+      end: 35
+    - source: password="mypassword"
+      style: secondary
+      start: 14
+      end: 35
+    - source: (password="mypassword")
+      style: secondary
+      start: 13
+      end: 36

tests/python/python-webrepl-hardcoded-secret-python-test.yml

@@ -0,0 +1,9 @@
+id: python-webrepl-hardcoded-secret-python
+valid:
+  - |
+    webrepl.start(password=os.getenv('PASSWORD'))
+invalid:
+  - |
+    webrepl.start(password="mypassword")
+  - |
+    webrepl.start(password="12345")