Skip to content

Commit 670f26f

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add static analysis rules for C++ and Rust security checks (#128)
* removed missing-secure-java * sizeof-this-cpp * tokio-postgres-empty-password-rust * tokio-postgres-hardcoded-password-rust --------- Co-authored-by: Sakshis <[email protected]>
1 parent 36b59a3 commit 670f26f

10 files changed

+761
-1
lines changed

‎rules/cpp/sizeof-this-cpp.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
id: sizeof-this-cpp
2+
language: cpp
3+
severity: warning
4+
message: >-
5+
Do not use `sizeof(this)` to get the number of bytes of the object in
6+
memory. It returns the size of the pointer, not the size of the object.
7+
note: >-
8+
[CWE-467]: Use of sizeof() on a Pointer Type
9+
[REFERENCES]
10+
- https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array
11+
utils:
12+
match_sizeof_this:
13+
kind: sizeof_expression
14+
has:
15+
kind: parenthesized_expression
16+
has:
17+
kind: this
18+
regex: "^this$"
19+
inside:
20+
stopBy: end
21+
kind: return_statement
22+
inside:
23+
kind: compound_statement
24+
follows:
25+
kind: function_declarator
26+
inside:
27+
kind: function_definition
28+
29+
rule:
30+
kind: sizeof_expression
31+
all:
32+
- has:
33+
stopBy: end
34+
kind: this
35+
- not:
36+
has:
37+
stopBy: end
38+
any:
39+
- nthChild: 2
40+
- kind: pointer_expression
41+
- kind: ERROR
42+
- kind: sizeof_expression
43+
44+

‎rules/rust/security/tokio-postgres-empty-password-rust.yml

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
id: tokio-postgres-empty-password-rust
2+
language: rust
3+
severity: warning
4+
message: >-
5+
The application uses an empty credential. This can lead to unauthorized
6+
access by either an internal or external malicious actor. It is
7+
recommended to rotate the secret and retrieve them from a secure secret
8+
vault or Hardware Security Module (HSM), alternatively environment
9+
variables can be used if allowed by your company policy.
10+
note: >-
11+
[CWE-287] Improper Authentication.
12+
[REFERENCES]
13+
- https://docs.rs/tokio-postgres/latest/tokio_postgres/
14+
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
15+
16+
17+
utils:
18+
MATCH_FOLLOW_1:
19+
follows:
20+
stopBy: end
21+
any:
22+
- kind: let_declaration
23+
all:
24+
- has:
25+
kind: identifier
26+
pattern: $CONFIG
27+
- has:
28+
kind: call_expression
29+
regex: ^tokio_postgres::Config::new\(\)$
30+
- kind: let_declaration
31+
all:
32+
- has:
33+
kind: identifier
34+
pattern: $CONFIG
35+
- has:
36+
kind: call_expression
37+
regex: ^Config::new\(\)$
38+
any:
39+
- follows:
40+
stopBy: end
41+
kind: use_declaration
42+
has:
43+
stopBy: end
44+
kind: scoped_identifier
45+
regex: ^tokio_postgres::Config$
46+
- inside:
47+
stopBy: end
48+
follows:
49+
stopBy: end
50+
kind: use_declaration
51+
has:
52+
stopBy: end
53+
kind: scoped_identifier
54+
regex: ^tokio_postgres::Config$
55+
56+
57+
rule:
58+
kind: call_expression
59+
not:
60+
has:
61+
stopBy: end
62+
kind: ERROR
63+
any:
64+
# CONFIG IS DIRECT AND PWD IS DIRECT
65+
- all:
66+
- has:
67+
stopBy: end
68+
kind: scoped_identifier
69+
regex: ^tokio_postgres::Config::new()$
70+
- has:
71+
kind: field_expression
72+
regex: \.password$
73+
nthChild: 1
74+
- has:
75+
kind: arguments
76+
nthChild: 2
77+
has:
78+
stopBy: end
79+
kind: string_literal
80+
not:
81+
has:
82+
kind: string_content
83+
nthChild: 1
84+
all:
85+
- not:
86+
has:
87+
stopBy: end
88+
nthChild: 2
89+
- not:
90+
has:
91+
stopBy: end
92+
any:
93+
- kind: block
94+
- kind: array_expression
95+
# CONFIG IS DIRECT AND PWD IS INSTANCE
96+
- all:
97+
- has:
98+
stopBy: end
99+
kind: scoped_identifier
100+
regex: ^tokio_postgres::Config::new()$
101+
- has:
102+
kind: field_expression
103+
regex: \.password$
104+
nthChild: 1
105+
- has:
106+
kind: arguments
107+
nthChild: 2
108+
has:
109+
stopBy: end
110+
kind: identifier
111+
pattern: $PASSWORD
112+
inside:
113+
stopBy: end
114+
follows:
115+
stopBy: end
116+
any:
117+
- kind: let_declaration
118+
has:
119+
kind: identifier
120+
pattern: $PASSWORD
121+
precedes:
122+
stopBy: end
123+
kind: string_literal
124+
not:
125+
has:
126+
kind: string_content
127+
- kind: expression_statement
128+
has:
129+
kind: assignment_expression
130+
has:
131+
kind: identifier
132+
pattern: $PASSWORD
133+
precedes:
134+
stopBy: end
135+
kind: string_literal
136+
not:
137+
has:
138+
kind: string_content
139+
140+
nthChild: 1
141+
all:
142+
- not:
143+
has:
144+
stopBy: end
145+
nthChild: 2
146+
- not:
147+
has:
148+
stopBy: end
149+
any:
150+
- kind: block
151+
- kind: array_expression
152+
# CONFIG IS INSTANCE AND PWD IS DIRECT
153+
- all:
154+
- has:
155+
stopBy: end
156+
kind: identifier
157+
pattern: $CONFIG
158+
any:
159+
- inside:
160+
stopBy: end
161+
matches: MATCH_FOLLOW_1
162+
- has:
163+
kind: field_expression
164+
regex: \.password$
165+
nthChild: 1
166+
- has:
167+
kind: arguments
168+
nthChild: 2
169+
has:
170+
stopBy: end
171+
kind: string_literal
172+
not:
173+
has:
174+
kind: string_content
175+
nthChild: 1
176+
all:
177+
- not:
178+
has:
179+
stopBy: end
180+
nthChild: 2
181+
- not:
182+
has:
183+
stopBy: end
184+
any:
185+
- kind: block
186+
- kind: array_expression
187+
# CONFIG IS INSTANCE AND PWD IS INSTANCE
188+
- all:
189+
- has:
190+
stopBy: end
191+
kind: identifier
192+
pattern: $CONFIG
193+
any:
194+
- inside:
195+
stopBy: end
196+
matches: MATCH_FOLLOW_1
197+
- has:
198+
kind: field_expression
199+
regex: \.password$
200+
nthChild: 1
201+
- has:
202+
kind: arguments
203+
nthChild: 2
204+
has:
205+
stopBy: end
206+
kind: identifier
207+
pattern: $PASSWORD
208+
nthChild: 1
209+
inside:
210+
stopBy: end
211+
follows:
212+
stopBy: end
213+
any:
214+
- kind: let_declaration
215+
all:
216+
- has:
217+
kind: identifier
218+
pattern: $PASSWORD
219+
- has:
220+
kind: string_literal
221+
not:
222+
has:
223+
kind: string_content
224+
- kind: expression_statement
225+
has:
226+
kind: assignment_expression
227+
all:
228+
- has:
229+
kind: identifier
230+
pattern: $PASSWORD
231+
- has:
232+
kind: string_literal
233+
not:
234+
has:
235+
kind: string_content
236+
237+
all:
238+
- not:
239+
has:
240+
stopBy: end
241+
nthChild: 2
242+
- not:
243+
has:
244+
stopBy: end
245+
any:
246+
- kind: block
247+
- kind: array_expression
248+

0 commit comments

Comments
 (0)