Skip to content

Commit a57646f

Browse files
author
Sakshis
committed
python-neo4j-hardcoded-secret-auth-python
1 parent 1c98514 commit a57646f

File tree

3 files changed

+497
-0
lines changed

3 files changed

+497
-0
lines changed

‎rules/python/security/python-neo4j-hardcoded-secret-auth-python.yml

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
id: python-neo4j-hardcoded-secret-auth-python
2+
language: python
3+
severity: warning
4+
message: >-
5+
A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).
6+
note: >-
7+
[CWE-798]: Use of Hard-coded Credentials
8+
[A07:2021]: Identification and Authentication Failures
9+
[REFERENCES]
10+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
11+
12+
rule:
13+
kind: call
14+
any:
15+
- all:
16+
- has:
17+
nthChild: 1
18+
kind: identifier
19+
value: function
20+
any:
21+
- regex: ^(kerberos_auth|bearer_auth)$
22+
- pattern: $ALIAS1
23+
inside:
24+
stopBy: end
25+
follows:
26+
stopBy: end
27+
kind: import_from_statement
28+
all:
29+
- has:
30+
kind: dotted_name
31+
field: module_name
32+
regex: ^neo4j$
33+
- has:
34+
kind: aliased_import
35+
all:
36+
- has:
37+
kind: dotted_name
38+
field: name
39+
regex: ^(kerberos_auth|bearer_auth)$
40+
- has:
41+
kind: identifier
42+
field: alias
43+
pattern: $ALIAS1
44+
- has:
45+
kind: argument_list
46+
nthChild: 2
47+
has:
48+
kind: string
49+
nthChild: 1
50+
all:
51+
- has:
52+
kind: string_start
53+
nthChild: 1
54+
- has:
55+
kind: string_content
56+
nthChild: 2
57+
- has:
58+
kind: string_end
59+
nthChild: 3
60+
- all:
61+
- has:
62+
nthChild: 1
63+
kind: identifier
64+
value: function
65+
any:
66+
- regex: ^(custom_auth|basic_auth)$
67+
- pattern: $ALIAS2
68+
inside:
69+
stopBy: end
70+
follows:
71+
stopBy: end
72+
kind: import_from_statement
73+
all:
74+
- has:
75+
kind: dotted_name
76+
field: module_name
77+
regex: ^neo4j$
78+
- has:
79+
kind: aliased_import
80+
all:
81+
- has:
82+
kind: dotted_name
83+
field: name
84+
regex: ^(custom_auth|basic_auth)$
85+
- has:
86+
kind: identifier
87+
field: alias
88+
pattern: $ALIAS2
89+
- has:
90+
kind: argument_list
91+
nthChild: 2
92+
has:
93+
kind: string
94+
nthChild: 2
95+
all:
96+
- has:
97+
kind: string_start
98+
nthChild: 1
99+
- has:
100+
kind: string_content
101+
nthChild: 2
102+
- has:
103+
kind: string_end
104+
nthChild: 3

0 commit comments

Comments
 (0)