Skip to content

Add Java rules for detecting hardcoded secrets in System.setProperty and OkHttp #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Mar 12, 2025
Merged

Add Java rules for detecting hardcoded secrets in System.setProperty and OkHttp #175

merged 2 commits into from
Mar 12, 2025

Conversation

ESS-ENN
Copy link
Contributor

@ESS-ENN ESS-ENN commented Mar 11, 2025 •
edited by coderabbitai bot
Loading

Summary by CodeRabbit

  • New Features

    • Implemented enhanced security checks to detect hardcoded secrets in Java applications. These new mechanisms help identify insecure practices when setting system properties and configuring authentication.

  • Tests

    • Added comprehensive test scenarios and snapshots to validate the accuracy of the new security checks, ensuring that only secure configurations are accepted.

@coderabbitai coderabbitai
Copy link

coderabbitai bot commented Mar 11, 2025 •
edited
Loading

Walkthrough

This pull request adds two new rule configuration files with accompanying snapshot and test files to detect hardcoded secrets in Java applications. One rule targets insecure use of System.setProperty for sensitive values, while the other focuses on hardcoded credentials via OkHttp’s Credentials.basic method. Both rules incorporate multiple matching strategies to avoid false positives and include detailed messages advising secure practices. The snapshots and tests provide concrete examples for validating both valid and invalid use cases for each rule.

Changes

Files Change Summary
rules/.../system-setproperty-hardcoded-secret-java.yml
rules/.../hardcoded-secret-in-credentials-java.yml		 Add new security rules to detect hardcoded secrets in Java: one for System.setProperty usage and one for Credentials.basic usage.
tests/.../system-setproperty-hardcoded-secret-java-snapshot.yml
tests/.../hardcoded-secret-in-credentials-java-snapshot.yml		 Introduce snapshot files capturing code examples with hardcoded secrets for both system properties and OkHttp credentials.
tests/.../system-setproperty-hardcoded-secret-java-test.yml
tests/.../hardcoded-secret-in-credentials-java-test.yml		 Provide YAML test cases defining valid and invalid examples to verify detection of insecure hardcoded secret practices.

Sequence Diagram(s)

sequenceDiagram
    participant Code
    participant Analyzer
    participant Rule_System
    participant Rule_Credentials
    Code->>Analyzer: Submit Java source code
    Analyzer->>Rule_System: Evaluate System.setProperty rule
    Rule_System-->>Analyzer: Return match results (if any)
    Analyzer->>Rule_Credentials: Evaluate Credentials.basic rule
    Rule_Credentials-->>Analyzer: Return match results (if any)
    Analyzer->>Code: Report any security warnings
Loading

Possibly related PRs

Suggested reviewers

  • ganeshpatro321

Poem

I’m a rabbit hopping through the code,
Spotting secrets hidden in each node.
With rules so keen, the bugs retreat,
In YAML hops, the errors meet.
I nibble on flaws with a cheerful beat! 🐰✨
Happy code days, so pure and sweet!

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@coderabbitai coderabbitai bot changed the title @coderabbitai Add Java rules for detecting hardcoded secrets in System.setProperty and OkHttp Mar 11, 2025
coderabbitai[bot]
coderabbitai bot reviewed Mar 11, 2025
View reviewed changes
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (9)
tests/java/hardcoded-secret-in-credentials-java-test.yml (3)

9-9: Trailing Spaces Detected
There are trailing spaces at line 9. Please remove these extra whitespace characters to adhere to YAMLlint guidelines.

🧰 Tools
🪛 YAMLlint (1.35.1)

[error] 9-9: trailing spaces

(trailing-spaces)

17-17: Trailing Spaces Detected
Line 17 also contains trailing spaces. Removing these will help maintain clean formatting.

🧰 Tools
🪛 YAMLlint (1.35.1)

[error] 17-17: trailing spaces

(trailing-spaces)

20-20: Missing Newline at End of File
The file is missing a newline character at the end (line 20). Adding a newline will resolve the YAMLlint error and improve file consistency.

🧰 Tools
🪛 YAMLlint (1.35.1)

[error] 20-20: no new line character at the end of file

(new-line-at-end-of-file)

tests/java/system-setproperty-hardcoded-secret-java-test.yml (1)

9-9: Missing Newline at End of File
A newline is missing at the end of the file (line 9). Please add a newline to conform with YAML formatting best practices.

🧰 Tools
🪛 YAMLlint (1.35.1)

[error] 9-9: no new line character at the end of file

(new-line-at-end-of-file)

rules/java/security/system-setproperty-hardcoded-secret-java.yml (1)

17-315: YAML Formatting Issues in the utils Block
Multiple YAMLlint warnings have been reported throughout the utils block (e.g., indentation warnings on lines 18, 20, 22, and trailing spaces on several lines).
It is recommended to reformat this section so that each nested level uses a consistent 4-space indentation and to remove any trailing whitespace. For example, you may apply a diff similar to the following for the initial part of the block:

-utils:
-  match_string_literal:
-   kind: string_fragment
-   inside:
-    kind: string_literal
-    all:
-     - nthChild: 
-        position: 2
-        ofRule:
-         not:
-          kind: line_comment
+utils:
+    match_string_literal:
+        kind: string_fragment
+        inside:
+            kind: string_literal
+            all:
+                - nthChild:
+                      position: 2
+                      ofRule:
+                          not:
+                              kind: line_comment

Please review the entire utils section and adjust the indentation and remove trailing spaces as needed.

🧰 Tools
🪛 YAMLlint (1.35.1)

[warning] 18-18: wrong indentation: expected 4 but found 3

(indentation)

[warning] 20-20: wrong indentation: expected 5 but found 4

(indentation)

[warning] 22-22: wrong indentation: expected 6 but found 5

(indentation)

[error] 22-22: trailing spaces

(trailing-spaces)

[warning] 23-23: wrong indentation: expected 9 but found 8

(indentation)

[warning] 25-25: wrong indentation: expected 10 but found 9

(indentation)

[warning] 26-26: wrong indentation: expected 11 but found 10

(indentation)

[error] 32-32: trailing spaces

(trailing-spaces)

[warning] 33-33: wrong indentation: expected 19 but found 18

(indentation)

[error] 42-42: trailing spaces

(trailing-spaces)

[warning] 43-43: wrong indentation: expected 17 but found 16

(indentation)

[error] 58-58: trailing spaces

(trailing-spaces)

[warning] 63-63: wrong indentation: expected 6 but found 5

(indentation)

[error] 63-63: trailing spaces

(trailing-spaces)

[warning] 64-64: wrong indentation: expected 9 but found 8

(indentation)

[warning] 66-66: wrong indentation: expected 10 but found 9

(indentation)

[warning] 67-67: wrong indentation: expected 11 but found 10

(indentation)

[error] 73-73: trailing spaces

(trailing-spaces)

[warning] 74-74: wrong indentation: expected 19 but found 18

(indentation)

[error] 83-83: trailing spaces

(trailing-spaces)

[warning] 84-84: wrong indentation: expected 17 but found 16

(indentation)

[warning] 103-103: wrong indentation: expected 27 but found 28

(indentation)

[warning] 118-118: wrong indentation: expected 25 but found 28

(indentation)

[error] 132-132: trailing spaces

(trailing-spaces)

[error] 133-133: trailing spaces

(trailing-spaces)

[warning] 135-135: wrong indentation: expected 4 but found 3

(indentation)

[warning] 137-137: wrong indentation: expected 5 but found 4

(indentation)

[warning] 139-139: wrong indentation: expected 6 but found 5

(indentation)

[error] 139-139: trailing spaces

(trailing-spaces)

[warning] 140-140: wrong indentation: expected 9 but found 8

(indentation)

[warning] 142-142: wrong indentation: expected 10 but found 9

(indentation)

[warning] 143-143: wrong indentation: expected 11 but found 10

(indentation)

[error] 149-149: trailing spaces

(trailing-spaces)

[warning] 150-150: wrong indentation: expected 19 but found 18

(indentation)

[error] 157-157: trailing spaces

(trailing-spaces)

[warning] 158-158: wrong indentation: expected 17 but found 16

(indentation)

[warning] 177-177: wrong indentation: expected 27 but found 28

(indentation)

[warning] 193-193: wrong indentation: expected 25 but found 28

(indentation)

[warning] 213-213: wrong indentation: expected 6 but found 5

(indentation)

[error] 213-213: trailing spaces

(trailing-spaces)

[warning] 214-214: wrong indentation: expected 9 but found 8

(indentation)

[warning] 216-216: wrong indentation: expected 10 but found 9

(indentation)

[warning] 217-217: wrong indentation: expected 11 but found 10

(indentation)

[error] 223-223: trailing spaces

(trailing-spaces)

[warning] 224-224: wrong indentation: expected 19 but found 18

(indentation)

[error] 231-231: trailing spaces

(trailing-spaces)

[warning] 232-232: wrong indentation: expected 17 but found 16

(indentation)

[warning] 251-251: wrong indentation: expected 27 but found 28

(indentation)

[warning] 267-267: wrong indentation: expected 25 but found 28

(indentation)

[warning] 286-286: wrong indentation: expected 27 but found 28

(indentation)

[warning] 301-301: wrong indentation: expected 25 but found 28

(indentation)

rules/java/security/hardcoded-secret-in-credentials-java.yml (4)

1-292: Fix YAML Formatting to Meet Lint Standards
There are several YAMLlint warnings throughout the file regarding indentation and trailing whitespace (e.g., warnings on lines 18, 31–34, 39–40, and many others). Please review and adjust the indentation to use a consistent spacing level (typically 4 spaces per level) and remove any trailing spaces.

🧰 Tools
🪛 YAMLlint (1.35.1)

[warning] 18-18: wrong indentation: expected 4 but found 3

(indentation)

[warning] 31-31: wrong indentation: expected 11 but found 9

(indentation)

[error] 33-33: trailing spaces

(trailing-spaces)

[warning] 34-34: wrong indentation: expected 17 but found 16

(indentation)

[warning] 39-39: wrong indentation: expected 13 but found 12

(indentation)

[error] 40-40: trailing spaces

(trailing-spaces)

[warning] 48-48: wrong indentation: expected 9 but found 8

(indentation)

[warning] 53-53: wrong indentation: expected 12 but found 10

(indentation)

[error] 55-55: trailing spaces

(trailing-spaces)

[warning] 57-57: wrong indentation: expected 4 but found 3

(indentation)

[warning] 70-70: wrong indentation: expected 11 but found 9

(indentation)

[error] 72-72: trailing spaces

(trailing-spaces)

[warning] 73-73: wrong indentation: expected 17 but found 16

(indentation)

[warning] 78-78: wrong indentation: expected 13 but found 12

(indentation)

[error] 80-80: trailing spaces

(trailing-spaces)

[warning] 86-86: wrong indentation: expected 9 but found 8

(indentation)

[warning] 91-91: wrong indentation: expected 12 but found 10

(indentation)

[warning] 96-96: wrong indentation: expected 11 but found 10

(indentation)

[warning] 98-98: wrong indentation: expected 12 but found 10

(indentation)

[error] 98-98: trailing spaces

(trailing-spaces)

[warning] 111-111: wrong indentation: expected 4 but found 3

(indentation)

[warning] 120-120: wrong indentation: expected 11 but found 9

(indentation)

[error] 122-122: trailing spaces

(trailing-spaces)

[warning] 123-123: wrong indentation: expected 17 but found 16

(indentation)

[warning] 128-128: wrong indentation: expected 13 but found 12

(indentation)

[error] 129-129: trailing spaces

(trailing-spaces)

[warning] 137-137: wrong indentation: expected 9 but found 8

(indentation)

[warning] 142-142: wrong indentation: expected 12 but found 10

(indentation)

[warning] 145-145: wrong indentation: expected 4 but found 3

(indentation)

[warning] 154-154: wrong indentation: expected 11 but found 9

(indentation)

[error] 156-156: trailing spaces

(trailing-spaces)

[warning] 157-157: wrong indentation: expected 17 but found 16

(indentation)

[warning] 162-162: wrong indentation: expected 13 but found 12

(indentation)

[error] 164-164: trailing spaces

(trailing-spaces)

[warning] 170-170: wrong indentation: expected 9 but found 8

(indentation)

[warning] 175-175: wrong indentation: expected 12 but found 10

(indentation)

[warning] 178-178: wrong indentation: expected 4 but found 3

(indentation)

[warning] 198-198: wrong indentation: expected 11 but found 9

(indentation)

[error] 200-200: trailing spaces

(trailing-spaces)

[warning] 201-201: wrong indentation: expected 17 but found 16

(indentation)

[warning] 206-206: wrong indentation: expected 13 but found 12

(indentation)

[error] 207-207: trailing spaces

(trailing-spaces)

[warning] 215-215: wrong indentation: expected 9 but found 8

(indentation)

[warning] 220-220: wrong indentation: expected 12 but found 10

(indentation)

[warning] 221-221: too many spaces after colon

(colons)

[warning] 224-224: wrong indentation: expected 4 but found 3

(indentation)

[warning] 244-244: wrong indentation: expected 11 but found 9

(indentation)

[error] 246-246: trailing spaces

(trailing-spaces)

[warning] 247-247: wrong indentation: expected 17 but found 16

(indentation)

[warning] 252-252: wrong indentation: expected 13 but found 12

(indentation)

[error] 254-254: trailing spaces

(trailing-spaces)

[warning] 260-260: wrong indentation: expected 9 but found 8

(indentation)

[warning] 265-265: wrong indentation: expected 12 but found 10

(indentation)

[warning] 266-266: too many spaces after colon

(colons)

[warning] 270-270: wrong indentation: expected 11 but found 10

(indentation)

[warning] 272-272: wrong indentation: expected 12 but found 10

(indentation)

[error] 272-272: trailing spaces

(trailing-spaces)

[warning] 292-292: too many blank lines

(1 > 0) (empty-lines)

90-92: Review Import Pattern in the Utils Block
The pattern on line 92 (- pattern: import okhttp3?;) appears potentially incorrect. It likely should match a broader or different pattern (for example, it may be intended to be import okhttp3.*;). Please verify the intended import pattern for the OkHttp library to avoid false negatives.

🧰 Tools
🪛 YAMLlint (1.35.1)

[warning] 91-91: wrong indentation: expected 12 but found 10

(indentation)

220-222: Standardize Spacing in Import Declaration
Extra spaces after the colon (as seen on line 221) can lead to inconsistencies in YAML parsing. Please adjust the spacing to adhere to a consistent style.

🧰 Tools
🪛 YAMLlint (1.35.1)

[warning] 220-220: wrong indentation: expected 12 but found 10

(indentation)

[warning] 221-221: too many spaces after colon

(colons)

292-292: Remove Extra Blank Lines
There are extra blank lines at the end of the file that should be removed to clean up the file formatting.

🧰 Tools
🪛 YAMLlint (1.35.1)

[warning] 292-292: too many blank lines

(1 > 0) (empty-lines)

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c333c16 and 6902686.

📒 Files selected for processing (6)
  • rules/java/security/system-setproperty-hardcoded-secret-java.yml (1 hunks)
  • tests/__snapshots__/system-setproperty-hardcoded-secret-java-snapshot.yml (1 hunks)
  • tests/java/system-setproperty-hardcoded-secret-java-test.yml (1 hunks)
  • rules/java/security/hardcoded-secret-in-credentials-java.yml (1 hunks)
  • tests/__snapshots__/hardcoded-secret-in-credentials-java-snapshot.yml (1 hunks)
  • tests/java/hardcoded-secret-in-credentials-java-test.yml (1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.35.1)
tests/java/system-setproperty-hardcoded-secret-java-test.yml

[error] 9-9: no new line character at the end of file

(new-line-at-end-of-file)

tests/java/hardcoded-secret-in-credentials-java-test.yml

[error] 9-9: trailing spaces

(trailing-spaces)

[error] 17-17: trailing spaces

(trailing-spaces)

[error] 20-20: no new line character at the end of file

(new-line-at-end-of-file)

rules/java/security/hardcoded-secret-in-credentials-java.yml

[warning] 18-18: wrong indentation: expected 4 but found 3

(indentation)

[warning] 31-31: wrong indentation: expected 11 but found 9

(indentation)

[error] 33-33: trailing spaces

(trailing-spaces)

[warning] 34-34: wrong indentation: expected 17 but found 16

(indentation)

[warning] 39-39: wrong indentation: expected 13 but found 12

(indentation)

[error] 40-40: trailing spaces

(trailing-spaces)

[warning] 48-48: wrong indentation: expected 9 but found 8

(indentation)

[warning] 53-53: wrong indentation: expected 12 but found 10

(indentation)

[error] 55-55: trailing spaces

(trailing-spaces)

[warning] 57-57: wrong indentation: expected 4 but found 3

(indentation)

[warning] 70-70: wrong indentation: expected 11 but found 9

(indentation)

[error] 72-72: trailing spaces

(trailing-spaces)

[warning] 73-73: wrong indentation: expected 17 but found 16

(indentation)

[warning] 78-78: wrong indentation: expected 13 but found 12

(indentation)

[error] 80-80: trailing spaces

(trailing-spaces)

[warning] 86-86: wrong indentation: expected 9 but found 8

(indentation)

[warning] 91-91: wrong indentation: expected 12 but found 10

(indentation)

[warning] 96-96: wrong indentation: expected 11 but found 10

(indentation)

[warning] 98-98: wrong indentation: expected 12 but found 10

(indentation)

[error] 98-98: trailing spaces

(trailing-spaces)

[warning] 111-111: wrong indentation: expected 4 but found 3

(indentation)

[warning] 120-120: wrong indentation: expected 11 but found 9

(indentation)

[error] 122-122: trailing spaces

(trailing-spaces)

[warning] 123-123: wrong indentation: expected 17 but found 16

(indentation)

[warning] 128-128: wrong indentation: expected 13 but found 12

(indentation)

[error] 129-129: trailing spaces

(trailing-spaces)

[warning] 137-137: wrong indentation: expected 9 but found 8

(indentation)

[warning] 142-142: wrong indentation: expected 12 but found 10

(indentation)

[warning] 145-145: wrong indentation: expected 4 but found 3

(indentation)

[warning] 154-154: wrong indentation: expected 11 but found 9

(indentation)

[error] 156-156: trailing spaces

(trailing-spaces)

[warning] 157-157: wrong indentation: expected 17 but found 16

(indentation)

[warning] 162-162: wrong indentation: expected 13 but found 12

(indentation)

[error] 164-164: trailing spaces

(trailing-spaces)

[warning] 170-170: wrong indentation: expected 9 but found 8

(indentation)

[warning] 175-175: wrong indentation: expected 12 but found 10

(indentation)

[warning] 178-178: wrong indentation: expected 4 but found 3

(indentation)

[warning] 198-198: wrong indentation: expected 11 but found 9

(indentation)

[error] 200-200: trailing spaces

(trailing-spaces)

[warning] 201-201: wrong indentation: expected 17 but found 16

(indentation)

[warning] 206-206: wrong indentation: expected 13 but found 12

(indentation)

[error] 207-207: trailing spaces

(trailing-spaces)

[warning] 215-215: wrong indentation: expected 9 but found 8

(indentation)

[warning] 220-220: wrong indentation: expected 12 but found 10

(indentation)

[warning] 221-221: too many spaces after colon

(colons)

[warning] 224-224: wrong indentation: expected 4 but found 3

(indentation)

[warning] 244-244: wrong indentation: expected 11 but found 9

(indentation)

[error] 246-246: trailing spaces

(trailing-spaces)

[warning] 247-247: wrong indentation: expected 17 but found 16

(indentation)

[warning] 252-252: wrong indentation: expected 13 but found 12

(indentation)

[error] 254-254: trailing spaces

(trailing-spaces)

[warning] 260-260: wrong indentation: expected 9 but found 8

(indentation)

[warning] 265-265: wrong indentation: expected 12 but found 10

(indentation)

[warning] 266-266: too many spaces after colon

(colons)

[warning] 270-270: wrong indentation: expected 11 but found 10

(indentation)

[warning] 272-272: wrong indentation: expected 12 but found 10

(indentation)

[error] 272-272: trailing spaces

(trailing-spaces)

[warning] 292-292: too many blank lines

(1 > 0) (empty-lines)

rules/java/security/system-setproperty-hardcoded-secret-java.yml

[warning] 18-18: wrong indentation: expected 4 but found 3

(indentation)

[warning] 20-20: wrong indentation: expected 5 but found 4

(indentation)

[warning] 22-22: wrong indentation: expected 6 but found 5

(indentation)

[error] 22-22: trailing spaces

(trailing-spaces)

[warning] 23-23: wrong indentation: expected 9 but found 8

(indentation)

[warning] 25-25: wrong indentation: expected 10 but found 9

(indentation)

[warning] 26-26: wrong indentation: expected 11 but found 10

(indentation)

[error] 32-32: trailing spaces

(trailing-spaces)

[warning] 33-33: wrong indentation: expected 19 but found 18

(indentation)

[error] 42-42: trailing spaces

(trailing-spaces)

[warning] 43-43: wrong indentation: expected 17 but found 16

(indentation)

[error] 58-58: trailing spaces

(trailing-spaces)

[warning] 63-63: wrong indentation: expected 6 but found 5

(indentation)

[error] 63-63: trailing spaces

(trailing-spaces)

[warning] 64-64: wrong indentation: expected 9 but found 8

(indentation)

[warning] 66-66: wrong indentation: expected 10 but found 9

(indentation)

[warning] 67-67: wrong indentation: expected 11 but found 10

(indentation)

[error] 73-73: trailing spaces

(trailing-spaces)

[warning] 74-74: wrong indentation: expected 19 but found 18

(indentation)

[error] 83-83: trailing spaces

(trailing-spaces)

[warning] 84-84: wrong indentation: expected 17 but found 16

(indentation)

[warning] 103-103: wrong indentation: expected 27 but found 28

(indentation)

[warning] 118-118: wrong indentation: expected 25 but found 28

(indentation)

[error] 132-132: trailing spaces

(trailing-spaces)

[error] 133-133: trailing spaces

(trailing-spaces)

[warning] 135-135: wrong indentation: expected 4 but found 3

(indentation)

[warning] 137-137: wrong indentation: expected 5 but found 4

(indentation)

[warning] 139-139: wrong indentation: expected 6 but found 5

(indentation)

[error] 139-139: trailing spaces

(trailing-spaces)

[warning] 140-140: wrong indentation: expected 9 but found 8

(indentation)

[warning] 142-142: wrong indentation: expected 10 but found 9

(indentation)

[warning] 143-143: wrong indentation: expected 11 but found 10

(indentation)

[error] 149-149: trailing spaces

(trailing-spaces)

[warning] 150-150: wrong indentation: expected 19 but found 18

(indentation)

[error] 157-157: trailing spaces

(trailing-spaces)

[warning] 158-158: wrong indentation: expected 17 but found 16

(indentation)

[warning] 177-177: wrong indentation: expected 27 but found 28

(indentation)

[warning] 193-193: wrong indentation: expected 25 but found 28

(indentation)

[warning] 213-213: wrong indentation: expected 6 but found 5

(indentation)

[error] 213-213: trailing spaces

(trailing-spaces)

[warning] 214-214: wrong indentation: expected 9 but found 8

(indentation)

[warning] 216-216: wrong indentation: expected 10 but found 9

(indentation)

[warning] 217-217: wrong indentation: expected 11 but found 10

(indentation)

[error] 223-223: trailing spaces

(trailing-spaces)

[warning] 224-224: wrong indentation: expected 19 but found 18

(indentation)

[error] 231-231: trailing spaces

(trailing-spaces)

[warning] 232-232: wrong indentation: expected 17 but found 16

(indentation)

[warning] 251-251: wrong indentation: expected 27 but found 28

(indentation)

[warning] 267-267: wrong indentation: expected 25 but found 28

(indentation)

[warning] 286-286: wrong indentation: expected 27 but found 28

(indentation)

[warning] 301-301: wrong indentation: expected 25 but found 28

(indentation)

🔇 Additional comments (10)
tests/java/hardcoded-secret-in-credentials-java-test.yml (1)

1-5: Overall Structure and Coverage
The test file clearly distinguishes between valid and invalid Java code examples for hardcoded credentials. The valid case uses a variable for the keystore password, and the two invalid cases demonstrate different insecure practices (using a hardcoded literal and initializing a variable with a hardcoded value).

tests/java/system-setproperty-hardcoded-secret-java-test.yml (2)

1-5: Clear Definition of Valid Case
The test file properly defines a valid example using a variable for the keystore password. This example effectively contrasts with the insecure practices shown later.

6-9: Comprehensive Invalid Examples
The invalid examples clearly illustrate the risk by hardcoding values for both javax.net.ssl.keyStorePassword and javax.net.ssl.trustStorePassword. This should aid the detection rule’s effectiveness.

🧰 Tools
🪛 YAMLlint (1.35.1)

[error] 9-9: no new line character at the end of file

(new-line-at-end-of-file)

tests/__snapshots__/system-setproperty-hardcoded-secret-java-snapshot.yml (2)

1-4: Detailed Snapshot for Keystore Password
The first snapshot entry provides a comprehensive breakdown of the components in the System.setProperty call for setting the keystore password. The labels (with source positions and styles) are detailed and should support precise matching.

38-44: Detailed Snapshot for TrustStore Password
The snapshot entry for the trustStore password is consistent with the keystore example. The labels clearly capture the relevant parts of the method invocation, ensuring robust detection of hardcoded secrets.

tests/__snapshots__/hardcoded-secret-in-credentials-java-snapshot.yml (2)

1-4: Comprehensive Snapshot Entry (Variable Usage)
The first snapshot entry demonstrates the secure usage where the password is stored as a variable. The detailed labels (including start/end positions) are very useful for the matching engine.

57-61: Snapshot Entry for Hardcoded Literal
The second snapshot effectively captures a scenario where a hardcoded string ("asdf") is passed to Credentials.basic. The labels for this instance are appropriately detailed, facilitating detection of such insecure practices.

rules/java/security/system-setproperty-hardcoded-secret-java.yml (2)

1-14: Rule Metadata and Description
The metadata section (lines 1–14) is clear and describes the security concern well. The provided message and note reference the proper security guidelines and CWE.

316-322: Rule Logic Verification
The final rule block correctly aggregates multiple matching strategies using the any operator. The approach is comprehensive; just ensure that the ordering of match definitions is intentional and covers all detection scenarios as expected.

rules/java/security/hardcoded-secret-in-credentials-java.yml (1)

284-292: Validate Comprehensive Rule Matching Logic
The rule’s matching strategy is comprehensive and covers various forms of the Credentials.basic invocation (including instance and fully qualified usages). Confirm that these patterns correctly capture all intended cases and do not lead to false positives or negatives in practice. Overall, the logic is well-constructed.

🧰 Tools
🪛 YAMLlint (1.35.1)

[warning] 292-292: too many blank lines

(1 > 0) (empty-lines)

@ganeshpatro321 ganeshpatro321 merged commit 4f277d7 into main Mar 12, 2025
2 checks passed
@ganeshpatro321 ganeshpatro321 deleted the JAVA-RULES-hardcoded_secret branch March 12, 2025 05:55
@coderabbitai coderabbitai bot mentioned this pull request Mar 24, 2025
Merged
gatsby003 pushed a commit that referenced this pull request Jul 24, 2025
@ESS-ENN @gatsby003
Add Java rules for detecting hardcoded secrets in System.setProperty …
ef7de1e 
…and OkHttp (#175)

* system-setproperty-hardcoded-secret-java

* hardcoded-secret-in-credentials-java

---------

Co-authored-by: Sakshis <sakshil@abc.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ganeshpatro321 ganeshpatro321 ganeshpatro321 approved these changes

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ESS-ENN @ganeshpatro321