Skip to content

Commit c72b9cc

Browse files
ESS-ENNESS-ENN
authored
Add security rules for ARC4, hard-coded secrets, and passwords in Python and Ruby (#71)
* openai-hardcoded-secret-python * insecure-cipher-algorithm-rc4-python * hardcoded-http-auth-in-controller-ruby
1 parent 1e605af commit c72b9cc

9 files changed

+453
-0
lines changed

‎rules/python/security/insecure-cipher-algorithm-rc4-python.yml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
id: insecure-cipher-algorithm-rc4-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
Detected ARC4 cipher algorithm which is considered insecure. This
6+
algorithm is not cryptographically secure and can be reversed easily. Use
7+
secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block
8+
cipher such as AES with a block size of 128 bits. When using a block
9+
cipher, use a modern mode of operation that also provides authentication,
10+
such as GCM.
11+
note: >-
12+
[CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
13+
[REFERENCES]
14+
- https://cwe.mitre.org/data/definitions/326.html
15+
- https://www.pycryptodome.org/src/cipher/cipher
16+
utils:
17+
MATCH_PATTERN_arc4.new:
18+
kind: call
19+
all:
20+
- has:
21+
stopBy: end
22+
kind: attribute
23+
all:
24+
- has:
25+
stopBy: neighbor
26+
kind: identifier
27+
pattern: $X
28+
- has:
29+
stopBy: neighbor
30+
kind: identifier
31+
regex: '^new$'
32+
- has:
33+
stopBy: neighbor
34+
kind: argument_list
35+
has:
36+
stopBy: neighbor
37+
kind: identifier
38+
- inside:
39+
stopBy: end
40+
kind: expression_statement
41+
follows:
42+
stopBy: end
43+
kind: import_from_statement
44+
all:
45+
- has:
46+
stopBy: neighbor
47+
kind: dotted_name
48+
all:
49+
- has:
50+
stopBy: neighbor
51+
kind: identifier
52+
regex: '^Crypto$|^Cryptodome$'
53+
- has:
54+
stopBy: neighbor
55+
kind: identifier
56+
regex: '^Cipher$'
57+
- has:
58+
stopBy: neighbor
59+
kind: aliased_import
60+
all:
61+
- has:
62+
stopBy: neighbor
63+
kind: dotted_name
64+
has:
65+
stopBy: neighbor
66+
kind: identifier
67+
regex: '^ARC4$'
68+
- has:
69+
stopBy: neighbor
70+
kind: identifier
71+
pattern: $X
72+
73+
rule:
74+
kind: call
75+
any:
76+
- matches: MATCH_PATTERN_arc4.new
77+
- pattern: Cryptodome.Cipher.ARC4.new($$$)
78+
- pattern: Crypto.Cipher.ARC4.new($$$)
79+
80+
81+
82+
83+
84+
85+

‎rules/python/security/openai-hardcoded-secret-python.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: openai-hardcoded-secret-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798]: Use of Hard-coded Credentials
12+
[OWASP A07:2021]: Identification and Authentication Failures
13+
[REFERENCES]
14+
https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
15+
utils:
16+
match_api_key:
17+
kind: string_content
18+
regex: \b(sk-[[:alnum:]]{20}T3BlbkFJ[[:alnum:]]{20})\b
19+
inside:
20+
stopBy: end
21+
kind: string
22+
rule:
23+
all:
24+
- matches: match_api_key

‎rules/ruby/security/hardcoded-http-auth-in-controller-ruby.yml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
id: hardcoded-http-auth-in-controller-ruby
2+
language: ruby
3+
severity: warning
4+
message: >-
5+
Detected hardcoded password used in basic authentication in a
6+
controller class. Including this password in version control could expose
7+
this credential. Consider refactoring to use environment variables or
8+
configuration files
9+
note: >-
10+
[CWE-798] Use of Hard-coded Credentials.
11+
[REFERENCES]
12+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
13+
utils:
14+
MATCH_PASSWORD_STRING:
15+
kind: string
16+
inside:
17+
stopBy: end
18+
kind: pair
19+
all:
20+
- has:
21+
stopBy: neighbor
22+
kind: simple_symbol
23+
regex: '^:password$'
24+
- has:
25+
stopBy: neighbor
26+
kind: string
27+
- inside:
28+
stopBy: neighbor
29+
kind: argument_list
30+
inside:
31+
stopBy: end
32+
kind: call
33+
all:
34+
- has:
35+
stopBy: neighbor
36+
kind: identifier
37+
regex: '^http_basic_authenticate_with$'
38+
- inside:
39+
stopBy: neighbor
40+
kind: body_statement
41+
inside:
42+
stopBy: end
43+
kind: class
44+
all:
45+
- has:
46+
stopBy: neighbor
47+
kind: constant
48+
- has:
49+
stopBy: end
50+
kind: superclass
51+
has:
52+
stopBy: neighbor
53+
kind: constant
54+
regex: '^ApplicationController$'
55+
56+
rule:
57+
kind: string
58+
matches: MATCH_PASSWORD_STRING
59+

‎tests/__snapshots__/hardcoded-http-auth-in-controller-ruby-snapshot.yml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
id: hardcoded-http-auth-in-controller-ruby
2+
snapshots:
3+
? |-
4+
class DangerousController < ApplicationController
5+
http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index
6+
puts "do more stuff"
7+
end
8+
: labels:
9+
- source: '"secret"'
10+
style: primary
11+
start: 108
12+
end: 116
13+
- source: :password
14+
style: secondary
15+
start: 95
16+
end: 104
17+
- source: '"secret"'
18+
style: secondary
19+
start: 108
20+
end: 116
21+
- source: http_basic_authenticate_with
22+
style: secondary
23+
start: 50
24+
end: 78
25+
- source: DangerousController
26+
style: secondary
27+
start: 6
28+
end: 25
29+
- source: ApplicationController
30+
style: secondary
31+
start: 28
32+
end: 49
33+
- source: < ApplicationController
34+
style: secondary
35+
start: 26
36+
end: 49
37+
- source: |-
38+
class DangerousController < ApplicationController
39+
http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index
40+
puts "do more stuff"
41+
end
42+
style: secondary
43+
start: 0
44+
end: 160
45+
- source: |-
46+
http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index
47+
puts "do more stuff"
48+
style: secondary
49+
start: 50
50+
end: 156
51+
- source: http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index
52+
style: secondary
53+
start: 50
54+
end: 135
55+
- source: :name => "dhh", :password => "secret", :except => :index
56+
style: secondary
57+
start: 79
58+
end: 135
59+
- source: :password => "secret"
60+
style: secondary
61+
start: 95
62+
end: 116

‎tests/__snapshots__/insecure-cipher-algorithm-rc4-python-snapshot.yml

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
id: insecure-cipher-algorithm-rc4-python
2+
snapshots:
3+
? |
4+
Crypto.Cipher.ARC4.new()
5+
: labels:
6+
- source: Crypto.Cipher.ARC4.new()
7+
style: primary
8+
start: 0
9+
end: 24
10+
? |
11+
Crypto.Cipher.ARC4.new(adasfdasfs)
12+
: labels:
13+
- source: Crypto.Cipher.ARC4.new(adasfdasfs)
14+
style: primary
15+
start: 0
16+
end: 34
17+
? |
18+
Cryptodome.Cipher.ARC4.new()
19+
: labels:
20+
- source: Cryptodome.Cipher.ARC4.new()
21+
style: primary
22+
start: 0
23+
end: 28
24+
Cryptodome.Cipher.ARC4.new(asdsd):
25+
labels:
26+
- source: Cryptodome.Cipher.ARC4.new(asdsd)
27+
style: primary
28+
start: 0
29+
end: 33
30+
? |
31+
from Crypto.Cipher import ARC4 as pycrypto_arc4
32+
cipher = pycrypto_arc4.new(tempkey)
33+
: labels:
34+
- source: pycrypto_arc4.new(tempkey)
35+
style: primary
36+
start: 57
37+
end: 83
38+
- source: pycrypto_arc4
39+
style: secondary
40+
start: 57
41+
end: 70
42+
- source: new
43+
style: secondary
44+
start: 71
45+
end: 74
46+
- source: pycrypto_arc4.new
47+
style: secondary
48+
start: 57
49+
end: 74
50+
- source: tempkey
51+
style: secondary
52+
start: 75
53+
end: 82
54+
- source: (tempkey)
55+
style: secondary
56+
start: 74
57+
end: 83
58+
- source: Crypto
59+
style: secondary
60+
start: 5
61+
end: 11
62+
- source: Cipher
63+
style: secondary
64+
start: 12
65+
end: 18
66+
- source: Crypto.Cipher
67+
style: secondary
68+
start: 5
69+
end: 18
70+
- source: ARC4
71+
style: secondary
72+
start: 26
73+
end: 30
74+
- source: ARC4
75+
style: secondary
76+
start: 26
77+
end: 30
78+
- source: pycrypto_arc4
79+
style: secondary
80+
start: 34
81+
end: 47
82+
- source: ARC4 as pycrypto_arc4
83+
style: secondary
84+
start: 26
85+
end: 47
86+
- source: from Crypto.Cipher import ARC4 as pycrypto_arc4
87+
style: secondary
88+
start: 0
89+
end: 47
90+
- source: cipher = pycrypto_arc4.new(tempkey)
91+
style: secondary
92+
start: 48
93+
end: 83
94+
? |
95+
from Cryptodome.Cipher import ARC4 as pycryptodomex_arc4
96+
cipher = pycryptodomex_arc4.new(tempkey)
97+
: labels:
98+
- source: pycryptodomex_arc4.new(tempkey)
99+
style: primary
100+
start: 66
101+
end: 97
102+
- source: pycryptodomex_arc4
103+
style: secondary
104+
start: 66
105+
end: 84
106+
- source: new
107+
style: secondary
108+
start: 85
109+
end: 88
110+
- source: pycryptodomex_arc4.new
111+
style: secondary
112+
start: 66
113+
end: 88
114+
- source: tempkey
115+
style: secondary
116+
start: 89
117+
end: 96
118+
- source: (tempkey)
119+
style: secondary
120+
start: 88
121+
end: 97
122+
- source: Cryptodome
123+
style: secondary
124+
start: 5
125+
end: 15
126+
- source: Cipher
127+
style: secondary
128+
start: 16
129+
end: 22
130+
- source: Cryptodome.Cipher
131+
style: secondary
132+
start: 5
133+
end: 22
134+
- source: ARC4
135+
style: secondary
136+
start: 30
137+
end: 34
138+
- source: ARC4
139+
style: secondary
140+
start: 30
141+
end: 34
142+
- source: pycryptodomex_arc4
143+
style: secondary
144+
start: 38
145+
end: 56
146+
- source: ARC4 as pycryptodomex_arc4
147+
style: secondary
148+
start: 30
149+
end: 56
150+
- source: from Cryptodome.Cipher import ARC4 as pycryptodomex_arc4
151+
style: secondary
152+
start: 0
153+
end: 56
154+
- source: cipher = pycryptodomex_arc4.new(tempkey)
155+
style: secondary
156+
start: 57
157+
end: 97

0 commit comments

Comments
 (0)