openai-hardcoded-secret-password-python

Author: ESS-ENN

rules/python/security/openai-hardcoded-secret-python.yml

@@ -0,0 +1,24 @@
+id: openai-hardcoded-secret-password-python
+language: python
+severity: warning
+message: >-
+  A secret is hard-coded in the application. Secrets stored in source
+  code, such as credentials, identifiers, and other types of sensitive data,
+  can be leaked and used by internal or external malicious actors. Use
+  environment variables to securely provide credentials and other secrets or
+  retrieve them from a secure vault or Hardware Security Module (HSM).
+note: >-
+  [CWE-798]: Use of Hard-coded Credentials
+  [OWASP A07:2021]: Identification and Authentication Failures
+  [REFERENCES]
+       https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+utils:
+  match_api_key:
+    kind: string_content
+    pattern: $R
+rule:
+  all:
+    - matches: match_api_key
+constraints:
+  R:
+    regex: \b(sk-[[:alnum:]]{20}T3BlbkFJ[[:alnum:]]{20})\b

tests/__snapshots__/openai-hardcoded-secret-password-python-snapshot.yml

@@ -0,0 +1,10 @@
+id: openai-hardcoded-secret-password-python
+snapshots:
+  ? |
+    api_key="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"
+    f = "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"
+  : labels:
+    - source: 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
+      style: primary
+      start: 9
+      end: 60

tests/__snapshots__/python-ldap3-empty-password-python-snapshot.yml

@@ -0,0 +1,29 @@
+id: python-ldap3-empty-password-python
+snapshots:
+  ? |
+    ldap3.Connection(password="")
+  : labels:
+    - source: ldap3.Connection(password="")
+      style: primary
+      start: 0
+      end: 29
+    - source: ldap3.Connection
+      style: secondary
+      start: 0
+      end: 16
+    - source: password
+      style: secondary
+      start: 17
+      end: 25
+    - source: '""'
+      style: secondary
+      start: 26
+      end: 28
+    - source: password=""
+      style: secondary
+      start: 17
+      end: 28
+    - source: (password="")
+      style: secondary
+      start: 16
+      end: 29

tests/python/openai-hardcoded-secret-python-test.yml

@@ -0,0 +1,8 @@
+id: openai-hardcoded-secret-password-python
+valid:
+  - |
+    openai.api_key="sk-ExamplexT3BlbkFJp6xpvsfpkEsmAJawIm0V"
+invalid:
+  - |
+    api_key="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"
+    f = "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"