Skip to content

Commit 6cf05f7

Browse files
committed
openai-hardcoded-secret-password-python
1 parent 9ee1cb5 commit 6cf05f7

4 files changed

+71
-0
lines changed
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: openai-hardcoded-secret-password-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798]: Use of Hard-coded Credentials
12+
[OWASP A07:2021]: Identification and Authentication Failures
13+
[REFERENCES]
14+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
utils:
16+
match_api_key:
17+
kind: string_content
18+
pattern: $R
19+
rule:
20+
all:
21+
- matches: match_api_key
22+
constraints:
23+
R:
24+
regex: \b(sk-[[:alnum:]]{20}T3BlbkFJ[[:alnum:]]{20})\b
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
id: openai-hardcoded-secret-password-python
2+
snapshots:
3+
? |
4+
api_key="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"
5+
f = "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"
6+
: labels:
7+
- source: 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
8+
style: primary
9+
start: 9
10+
end: 60
Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: python-ldap3-empty-password-python
2+
snapshots:
3+
? |
4+
ldap3.Connection(password="")
5+
: labels:
6+
- source: ldap3.Connection(password="")
7+
style: primary
8+
start: 0
9+
end: 29
10+
- source: ldap3.Connection
11+
style: secondary
12+
start: 0
13+
end: 16
14+
- source: password
15+
style: secondary
16+
start: 17
17+
end: 25
18+
- source: '""'
19+
style: secondary
20+
start: 26
21+
end: 28
22+
- source: password=""
23+
style: secondary
24+
start: 17
25+
end: 28
26+
- source: (password="")
27+
style: secondary
28+
start: 16
29+
end: 29
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
id: openai-hardcoded-secret-password-python
2+
valid:
3+
- |
4+
openai.api_key="sk-ExamplexT3BlbkFJp6xpvsfpkEsmAJawIm0V"
5+
invalid:
6+
- |
7+
api_key="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"
8+
f = "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"

0 commit comments

Comments
 (0)