Skip to content

Commit 7c95a04

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add YAML rules and tests for detecting hard-coded secrets in C# (#161)
* removed missing-secure-java * httponly-false-csharp * use-of-md5-digest-utils-java * removing use-of-md5-digest-utils and httponly-false-csharp * sqlconnectionstringbuilder-hardcoded-secret-csharp * networkcredential-hardcoded-secret-csharp * npgsqlconnectionstringbuilder-hardcoded-secret-csharp * oracleconnectionstringbuilder-hardcoded-secret-csharp --------- Co-authored-by: Sakshis <[email protected]>
1 parent a7b3a4c commit 7c95a04

12 files changed

+2650
-0
lines changed

‎rules/csharp/security/networkcredential-hardcoded-secret-python.yml

+405
Large diffs are not rendered by default.

‎rules/csharp/security/npgsqlconnectionstringbuilder-hardcoded-secret-csharp.yml

+350
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,350 @@
1+
id: npgsqlconnectionstringbuilder-hardcoded-secret-csharp
2+
language: csharp
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798]: Use of Hard-coded Credentials
12+
[OWASP A07:2021]: Identification and Authentication Failures
13+
[REFERENCES]
14+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
16+
ast-grep-essentials: true
17+
18+
utils:
19+
match_NpgsqlConnectionStringBuilder_with_string:
20+
kind: assignment_expression
21+
all:
22+
- has:
23+
kind: member_access_expression
24+
all:
25+
- has:
26+
kind: identifier
27+
field: expression
28+
pattern: $U
29+
- has:
30+
kind: identifier
31+
field: name
32+
regex: "^Password$"
33+
- has:
34+
kind: string_literal
35+
inside:
36+
stopBy: end
37+
follows:
38+
stopBy: end
39+
kind: local_declaration_statement
40+
has:
41+
kind: variable_declaration
42+
all:
43+
- has:
44+
kind: identifier
45+
regex: "^NpgsqlConnectionStringBuilder$"
46+
- has:
47+
kind: variable_declarator
48+
all:
49+
- has:
50+
kind: identifier
51+
field: name
52+
pattern: $U
53+
- has:
54+
kind: object_creation_expression
55+
all:
56+
- has:
57+
kind: identifier
58+
- has:
59+
kind: argument_list
60+
61+
match_with_brackets:
62+
kind: assignment_expression
63+
all:
64+
- has:
65+
kind: element_access_expression
66+
all:
67+
- has:
68+
kind: identifier
69+
pattern: $U
70+
- has:
71+
kind: bracketed_argument_list
72+
has:
73+
kind: argument
74+
has:
75+
kind: string_literal
76+
has:
77+
kind: string_literal_content
78+
- has:
79+
kind: string_literal
80+
inside:
81+
stopBy: end
82+
follows:
83+
stopBy: end
84+
kind: local_declaration_statement
85+
has:
86+
kind: variable_declaration
87+
all:
88+
- has:
89+
kind: identifier
90+
regex: "^NpgsqlConnectionStringBuilder$"
91+
- has:
92+
kind: variable_declarator
93+
all:
94+
- has:
95+
kind: identifier
96+
field: name
97+
pattern: $U
98+
- has:
99+
kind: object_creation_expression
100+
all:
101+
- has:
102+
kind: identifier
103+
- has:
104+
kind: argument_list
105+
106+
match_instance_with_braces:
107+
kind: assignment_expression
108+
all:
109+
- has:
110+
kind: element_access_expression
111+
all:
112+
- has:
113+
kind: identifier
114+
pattern: $C
115+
- has:
116+
kind: bracketed_argument_list
117+
has:
118+
kind: argument
119+
has:
120+
kind: string_literal
121+
has:
122+
kind: string_literal_content
123+
- has:
124+
kind: string_literal
125+
inside:
126+
stopBy: end
127+
follows:
128+
stopBy: end
129+
kind: local_declaration_statement
130+
has:
131+
kind: variable_declaration
132+
has:
133+
kind: variable_declarator
134+
all:
135+
- has:
136+
kind: identifier
137+
pattern: $C
138+
- has:
139+
kind: object_creation_expression
140+
all:
141+
- has:
142+
kind: identifier
143+
regex: "^NpgsqlConnectionStringBuilder$"
144+
- has:
145+
kind: argument_list
146+
147+
match_instance_without_braces:
148+
kind: assignment_expression
149+
all:
150+
- has:
151+
kind: member_access_expression
152+
all:
153+
- has:
154+
kind: identifier
155+
field: expression
156+
pattern: $E
157+
- has:
158+
kind: identifier
159+
field: name
160+
regex: "^Password$"
161+
- has:
162+
kind: string_literal
163+
inside:
164+
stopBy: end
165+
follows:
166+
stopBy: end
167+
kind: local_declaration_statement
168+
has:
169+
kind: variable_declaration
170+
has:
171+
kind: variable_declarator
172+
all:
173+
- has:
174+
kind: identifier
175+
pattern: $E
176+
- has:
177+
kind: object_creation_expression
178+
all:
179+
- has:
180+
kind: identifier
181+
regex: "^NpgsqlConnectionStringBuilder$"
182+
- has:
183+
kind: argument_list
184+
185+
braces_instance:
186+
kind: assignment_expression
187+
all:
188+
- has:
189+
kind: element_access_expression
190+
all:
191+
- has:
192+
kind: identifier
193+
pattern: $Y
194+
- has:
195+
kind: bracketed_argument_list
196+
has:
197+
kind: argument
198+
has:
199+
kind: string_literal
200+
has:
201+
kind: string_literal_content
202+
- has:
203+
kind: identifier
204+
pattern: $P
205+
inside:
206+
stopBy: end
207+
all:
208+
- follows:
209+
stopBy: end
210+
kind: local_declaration_statement
211+
has:
212+
kind: variable_declaration
213+
has:
214+
kind: variable_declarator
215+
all:
216+
- has:
217+
kind: identifier
218+
pattern: $Y
219+
- has:
220+
kind: object_creation_expression
221+
all:
222+
- has:
223+
kind: identifier
224+
regex: "^NpgsqlConnectionStringBuilder$"
225+
- has:
226+
kind: argument_list
227+
- follows:
228+
stopBy: end
229+
kind: local_declaration_statement
230+
has:
231+
kind: variable_declaration
232+
has:
233+
kind: variable_declarator
234+
all:
235+
- has:
236+
kind: identifier
237+
field: name
238+
pattern: $P
239+
- has:
240+
kind: string_literal
241+
242+
match_password_with_instance:
243+
kind: assignment_expression
244+
all:
245+
- has:
246+
kind: member_access_expression
247+
all:
248+
- has:
249+
kind: identifier
250+
field: expression
251+
pattern: $K
252+
- has:
253+
kind: identifier
254+
field: name
255+
regex: "^Password$"
256+
- has:
257+
kind: identifier
258+
pattern: $T
259+
inside:
260+
stopBy: end
261+
all:
262+
- follows:
263+
stopBy: end
264+
kind: local_declaration_statement
265+
has:
266+
kind: variable_declaration
267+
has:
268+
kind: variable_declarator
269+
all:
270+
- has:
271+
kind: identifier
272+
field: name
273+
pattern: $T
274+
- has:
275+
kind: string_literal
276+
- follows:
277+
stopBy: end
278+
kind: local_declaration_statement
279+
has:
280+
kind: variable_declaration
281+
all:
282+
- has:
283+
kind: identifier
284+
regex: "^NpgsqlConnectionStringBuilder$"
285+
- has:
286+
kind: variable_declarator
287+
all:
288+
- has:
289+
kind: identifier
290+
field: name
291+
pattern: $K
292+
- has:
293+
kind: object_creation_expression
294+
all:
295+
- has:
296+
kind: identifier
297+
- has:
298+
kind: argument_list
299+
(NpgsqlConnectionStringBuilder $VALUE).Password = "$PASSWORD":
300+
kind: assignment_expression
301+
all:
302+
- has:
303+
kind: member_access_expression
304+
all:
305+
- has:
306+
kind: identifier
307+
pattern: $INSTANCE
308+
nthChild: 1
309+
- has:
310+
kind: identifier
311+
nthChild: 2
312+
regex: ^Password$
313+
- has:
314+
kind: string_literal
315+
has:
316+
kind: string_literal_content
317+
inside:
318+
stopBy: end
319+
follows:
320+
stopBy: end
321+
kind: field_declaration
322+
has:
323+
kind: variable_declaration
324+
all:
325+
- has:
326+
kind: identifier
327+
regex: "^NpgsqlConnectionStringBuilder$"
328+
- has:
329+
kind: variable_declarator
330+
all:
331+
- has:
332+
kind: identifier
333+
field: name
334+
pattern: $INSTANCE
335+
- has:
336+
kind: object_creation_expression
337+
all:
338+
- has:
339+
kind: identifier
340+
- has:
341+
kind: argument_list
342+
rule:
343+
any:
344+
- matches: match_NpgsqlConnectionStringBuilder_with_string
345+
- matches: match_with_brackets
346+
- matches: match_instance_with_braces
347+
- matches: match_instance_without_braces
348+
- matches: braces_instance
349+
- matches: match_password_with_instance
350+
- matches: (NpgsqlConnectionStringBuilder $VALUE).Password = "$PASSWORD"

0 commit comments

Comments
 (0)