Skip to content

Commit f948d87

Browse files
ESS-ENNESS-ENN
committed
drivermanager-hardcoded-secret-java
1 parent 1aebdd8 commit f948d87

File tree

3 files changed

+189
-0
lines changed

3 files changed

+189
-0
lines changed

‎rules/java/security/drivermanager-hardcoded-secret-java.yml

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
id: drivermanager-hardcoded-secret-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source
6+
code, such as credentials, identifiers, and other types of sensitive data,
7+
can be leaked and used by internal or external malicious actors. Use
8+
environment variables to securely provide credentials and other secrets or
9+
retrieve them from a secure vault or Hardware Security Module (HSM).
10+
note: >-
11+
[CWE-798] Use of Hard-coded Credentials.
12+
[REFERENCES]
13+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
14+
15+
ast-grep-essentials: true
16+
17+
utils:
18+
MATCH_PATTERN_DriverManager.getConnection:
19+
kind: method_invocation
20+
all:
21+
- has:
22+
stopBy: neighbor
23+
kind: identifier
24+
regex: '^DriverManager$'
25+
- has:
26+
stopBy: neighbor
27+
kind: identifier
28+
regex: '^getConnection$'
29+
- has:
30+
kind: argument_list
31+
# nthChild: 3
32+
all:
33+
- any:
34+
- has:
35+
stopBy: end
36+
kind: string_literal
37+
nthChild: 3
38+
pattern: $I
39+
has:
40+
stopBy: neighbor
41+
kind: string_fragment
42+
- has:
43+
stopBy: end
44+
kind: parenthesized_expression
45+
has:
46+
stopBy: end
47+
kind: string_fragment
48+
pattern: $I
49+
- has:
50+
nthChild: 3
51+
all:
52+
- has:
53+
stopBy: neighbor
54+
kind: string_fragment
55+
inside:
56+
stopBy: neighbor
57+
kind: string_literal
58+
- not:
59+
has:
60+
stopBy: end
61+
kind: string_literal
62+
not:
63+
has:
64+
stopBy: neighbor
65+
kind: string_fragment
66+
- not:
67+
has:
68+
stopBy: end
69+
regex: ^-$
70+
- not:
71+
has:
72+
nthChild: 4
73+
- not:
74+
has:
75+
stopBy: end
76+
kind: ERROR
77+
- not:
78+
has:
79+
stopBy: end
80+
kind: binary_expression
81+
82+
MATCH_PATTERN_DriverManagerDataSource:
83+
kind: object_creation_expression
84+
all:
85+
- has:
86+
stopBy: neighbor
87+
kind: type_identifier
88+
regex: '^DriverManagerDataSource$'
89+
- has:
90+
kind: argument_list
91+
# nthChild: 3
92+
all:
93+
- any:
94+
- has:
95+
stopBy: neighbor
96+
kind: string_literal
97+
nthChild: 3
98+
pattern: $I
99+
has:
100+
stopBy: neighbor
101+
kind: string_fragment
102+
- has:
103+
stopBy: end
104+
kind: parenthesized_expression
105+
has:
106+
stopBy: end
107+
kind: string_fragment
108+
pattern: $I
109+
- has:
110+
nthChild: 3
111+
all:
112+
- has:
113+
stopBy: neighbor
114+
kind: string_fragment
115+
inside:
116+
stopBy: neighbor
117+
kind: string_literal
118+
- not:
119+
has:
120+
stopBy: end
121+
kind: string_literal
122+
not:
123+
has:
124+
stopBy: neighbor
125+
kind: string_fragment
126+
- not:
127+
has:
128+
stopBy: end
129+
regex: ^-$
130+
- not:
131+
has:
132+
nthChild: 4
133+
- not:
134+
has:
135+
stopBy: end
136+
kind: binary_expression
137+
- not:
138+
has:
139+
stopBy: end
140+
kind: ERROR
141+
142+
rule:
143+
any:
144+
- kind: method_invocation
145+
matches: MATCH_PATTERN_DriverManager.getConnection
146+
- kind: object_creation_expression
147+
matches: MATCH_PATTERN_DriverManagerDataSource
148+
149+
constraints:
150+
I:
151+
not:
152+
regex: ^""$
153+

‎tests/__snapshots__/drivermanager-hardcoded-secret-java-snapshot.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: drivermanager-hardcoded-secret-java
2+
snapshots:
3+
? |
4+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password");
5+
: labels:
6+
- source: DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password")
7+
style: primary
8+
start: 17
9+
end: 101
10+
- source: DriverManager
11+
style: secondary
12+
start: 17
13+
end: 30
14+
- source: getConnection
15+
style: secondary
16+
start: 31
17+
end: 44
18+
- source: password
19+
style: secondary
20+
start: 91
21+
end: 99
22+
- source: '"password"'
23+
style: secondary
24+
start: 90
25+
end: 100
26+
- source: ("jdbc:oracle:thin:@localhost:1521:o92", "a", "password")
27+
style: secondary
28+
start: 44
29+
end: 101

‎tests/java/drivermanager-hardcoded-secret-java-test.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
id: drivermanager-hardcoded-secret-java
2+
valid:
3+
- |
4+
Connection conn = DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92","a");
5+
invalid:
6+
- |
7+
Connection conn =DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:o92", "a", "password");

0 commit comments

Comments
 (0)