Skip to content

Commit a97bc07

Browse files
author
Sakshis
committed
Rabbit-hardcoded-secret-swift
1 parent ee1cdba commit a97bc07

File tree

4 files changed

+622
-0
lines changed

4 files changed

+622
-0
lines changed

‎rules/swift/security/rabbit-hardcoded-secret-swift.yml

Lines changed: 357 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,357 @@
1+
id: rabbit-hardcoded-secret-swift
2+
severity: warning
3+
language: swift
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
ast-grep-essentials: true
15+
utils:
16+
match_pattern_try_expression_directly:
17+
kind: try_expression
18+
not:
19+
inside:
20+
stopBy: end
21+
kind: call_expression
22+
has:
23+
kind: simple_identifier
24+
regex: ^Rabbit$
25+
has:
26+
stopBy: neighbor
27+
kind: call_expression
28+
all:
29+
- has:
30+
kind: simple_identifier
31+
regex: '^Rabbit$'
32+
- has:
33+
kind: call_suffix
34+
has:
35+
kind: value_arguments
36+
has:
37+
kind: value_argument
38+
all:
39+
- has:
40+
stopBy: end
41+
kind: simple_identifier
42+
regex: '^key$'
43+
- has:
44+
stopBy: neighbor
45+
kind: line_string_literal
46+
has:
47+
kind: line_str_text
48+
- not:
49+
follows:
50+
stopBy: end
51+
kind: throw_keyword
52+
- not:
53+
inside:
54+
stopBy: end
55+
kind: throw_keyword
56+
57+
match_pattern_Rabbit_statement_directly:
58+
kind: call_expression
59+
not:
60+
inside:
61+
stopBy: end
62+
kind: call_expression
63+
has:
64+
kind: simple_identifier
65+
regex: ^Rabbit$
66+
all:
67+
- has:
68+
stopBy: end
69+
kind: simple_identifier
70+
regex: '^Rabbit$'
71+
- has:
72+
stopBy: end
73+
kind: call_suffix
74+
has:
75+
stopBy: end
76+
kind: value_arguments
77+
has:
78+
stopBy: end
79+
kind: value_argument
80+
all:
81+
- has:
82+
stopBy: end
83+
kind: simple_identifier
84+
regex: '^key$'
85+
- has:
86+
kind: line_string_literal
87+
has:
88+
stopBy: end
89+
kind: line_str_text
90+
- not:
91+
inside:
92+
stopBy: end
93+
kind: try_expression
94+
- not:
95+
follows:
96+
stopBy: end
97+
kind: throw_keyword
98+
- not:
99+
inside:
100+
stopBy: end
101+
kind: throw_keyword
102+
- not:
103+
inside:
104+
kind: function_declaration
105+
106+
match_pattern_Rabbit_expression_with_instance:
107+
kind: call_expression
108+
not:
109+
inside:
110+
stopBy: end
111+
kind: call_expression
112+
has:
113+
kind: simple_identifier
114+
regex: ^Rabbit$
115+
all:
116+
- has:
117+
kind: simple_identifier
118+
regex: '^Rabbit$'
119+
- has:
120+
kind: call_suffix
121+
has:
122+
kind: value_arguments
123+
has:
124+
kind: value_argument
125+
all:
126+
- has:
127+
stopBy: end
128+
kind: simple_identifier
129+
regex: '^key$'
130+
- has:
131+
kind: simple_identifier
132+
nthChild: 2
133+
pattern: $R
134+
- not:
135+
inside:
136+
stopBy: neighbor
137+
kind: try_expression
138+
- any:
139+
- follows:
140+
stopBy: end
141+
kind: property_declaration
142+
all:
143+
- has:
144+
kind: pattern
145+
has:
146+
stopBy: end
147+
kind: simple_identifier
148+
pattern: $R
149+
- has:
150+
stopBy: neighbor
151+
kind: call_expression
152+
pattern: Array($SECRET.utf8)
153+
- inside:
154+
stopBy: end
155+
follows:
156+
stopBy: end
157+
kind: property_declaration
158+
all:
159+
- has:
160+
kind: pattern
161+
has:
162+
kind: simple_identifier
163+
pattern: $R
164+
- has:
165+
stopBy: neighbor
166+
kind: call_expression
167+
pattern: Array($SECRET.utf8)
168+
- not:
169+
follows:
170+
stopBy: end
171+
kind: throw_keyword
172+
- not:
173+
inside:
174+
stopBy: end
175+
kind: throw_keyword
176+
- not:
177+
inside:
178+
kind: function_declaration
179+
180+
match_pattern_try_expression_with_instance:
181+
kind: try_expression
182+
not:
183+
inside:
184+
stopBy: end
185+
kind: call_expression
186+
has:
187+
kind: simple_identifier
188+
regex: ^Rabbit$
189+
all:
190+
- has:
191+
stopBy: neighbor
192+
kind: call_expression
193+
all:
194+
- has:
195+
kind: simple_identifier
196+
regex: '^Rabbit$'
197+
- has:
198+
kind: call_suffix
199+
has:
200+
kind: value_arguments
201+
has:
202+
kind: value_argument
203+
all:
204+
- has:
205+
stopBy: end
206+
kind: simple_identifier
207+
regex: '^key$'
208+
- has:
209+
kind: simple_identifier
210+
nthChild: 2
211+
pattern: $R
212+
- not:
213+
follows:
214+
stopBy: end
215+
kind: throw_keyword
216+
- not:
217+
inside:
218+
stopBy: end
219+
kind: throw_keyword
220+
- any:
221+
- follows:
222+
stopBy: end
223+
kind: property_declaration
224+
all:
225+
- has:
226+
kind: pattern
227+
has:
228+
kind: simple_identifier
229+
pattern: $R
230+
- has:
231+
stopBy: neighbor
232+
kind: call_expression
233+
pattern: Array($SECRET.utf8)
234+
- inside:
235+
stopBy: end
236+
follows:
237+
stopBy: end
238+
kind: property_declaration
239+
all:
240+
- has:
241+
kind: pattern
242+
has:
243+
kind: simple_identifier
244+
pattern: $R
245+
- has:
246+
stopBy: neighbor
247+
kind: call_expression
248+
pattern: Array($SECRET.utf8)
249+
250+
match_pattern_try_expression_with_utf8:
251+
kind: try_expression
252+
not:
253+
inside:
254+
stopBy: end
255+
kind: call_expression
256+
has:
257+
kind: simple_identifier
258+
regex: ^Rabbit$
259+
has:
260+
stopBy: end
261+
kind: call_expression
262+
all:
263+
- not:
264+
follows:
265+
stopBy: end
266+
kind: throw_keyword
267+
- not:
268+
inside:
269+
stopBy: end
270+
kind: throw_keyword
271+
- has:
272+
stopBy: end
273+
kind: simple_identifier
274+
regex: '^Rabbit$'
275+
- has:
276+
stopBy: neighbor
277+
kind: call_suffix
278+
has:
279+
stopBy: end
280+
kind: value_argument
281+
all:
282+
- has:
283+
stopBy: end
284+
kind: simple_identifier
285+
regex: ^key$
286+
- has:
287+
stopBy: end
288+
kind: call_expression
289+
pattern: Array($SECRET.utf8)
290+
291+
match_pattern_Rabbit_expression_with_utf8:
292+
kind: call_expression
293+
not:
294+
inside:
295+
stopBy: end
296+
kind: call_expression
297+
has:
298+
kind: simple_identifier
299+
regex: ^Rabbit$
300+
all:
301+
- not:
302+
inside:
303+
kind: function_declaration
304+
- not:
305+
follows:
306+
stopBy: end
307+
kind: throw_keyword
308+
- not:
309+
inside:
310+
stopBy: end
311+
kind: throw_keyword
312+
- not:
313+
inside:
314+
stopBy: end
315+
kind: try_expression
316+
- has:
317+
stopBy: neighbor
318+
kind: simple_identifier
319+
regex: '^Rabbit$'
320+
- has:
321+
stopBy: neighbor
322+
kind: call_suffix
323+
has:
324+
stopBy: end
325+
kind: value_argument
326+
all:
327+
- has:
328+
stopBy: end
329+
kind: simple_identifier
330+
regex: ^key$
331+
- has:
332+
stopBy: end
333+
kind: call_expression
334+
pattern: Array($SECRET.utf8)
335+
336+
rule:
337+
any:
338+
- kind: try_expression
339+
any:
340+
- matches: match_pattern_try_expression_directly
341+
- matches: match_pattern_try_expression_with_instance
342+
- matches: match_pattern_try_expression_with_utf8
343+
344+
- kind: call_expression
345+
any:
346+
- matches: match_pattern_Rabbit_statement_directly
347+
- matches: match_pattern_Rabbit_expression_with_instance
348+
- matches: match_pattern_Rabbit_expression_with_utf8
349+
350+
constraints:
351+
SECRET:
352+
kind: line_string_literal
353+
has:
354+
stopBy: neighbor
355+
kind: line_str_text
356+
field: text
357+

0 commit comments

Comments
 (0)