Add rules for detecting hard-coded secrets in Python and Ruby applications #111
Conversation
|
Sakshis seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
WalkthroughThis pull request introduces new rules for detecting hard-coded secrets in Python and Ruby applications. Specifically, it adds rules for the Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
coderabbitai
bot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Outside diff range and nitpick comments (7)
tests/python/python-psycopg2-hardcoded-secret-python-test.yml (2)
2-5: Consider adding more test cases for the valid section.The valid section could benefit from additional examples showing recommended practices:
- Using environment variables (e.g.,
os.environ.get('DB_PASSWORD'))- Using secure configuration management
- Using connection strings from environment variables
6-13: Add test cases for additional scenarios.Consider adding these test cases to the invalid section:
- Empty string password:
psycopg2.connect(password="")- Multi-line connection string
- Different variable names for password (e.g.,
pwd,passwd)- String concatenation:
psycopg2.connect(password="pass" + "word")rules/python/security/python-psycopg2-hardcoded-secret-python.yml (1)
4-9: Enhance the message with specific remediation steps.The current message could be more actionable by including:
- Example of using environment variables
- Reference to specific secure vault solutions (e.g., HashiCorp Vault, AWS Secrets Manager)
- Link to language-specific best practices for secrets management
tests/__snapshots__/python-psycopg2-hardcoded-secret-python-snapshot.yml (1)
7-55: Simplify overlapping label ranges.The current snapshot contains multiple overlapping ranges for the same code segments. Consider:
- Reducing redundant labels (e.g., lines 44-51 duplicate lines 48-55)
- Using more specific ranges to avoid overlap
rules/ruby/security/ruby-octokit-hardcoded-secret-ruby.yml (1)
4-9: Enhance the warning message with specific guidance.Consider adding specific examples of secure alternatives in the message:
- Using environment variables (e.g.,
ENV['GITHUB_TOKEN'])- Using credential management services
- Using configuration files outside version control
message: >- A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use - environment variables to securely provide credentials and other secrets or - retrieve them from a secure vault or Hardware Security Module (HSM). + environment variables (e.g., ENV['GITHUB_TOKEN']) to securely provide credentials, + or retrieve them from secure vaults (e.g., AWS Secrets Manager, HashiCorp Vault) + or Hardware Security Modules (HSM). Never commit credentials to version control.tests/ruby/ruby-octokit-hardcoded-secret-ruby-test.yml (1)
6-25: Consider adding more edge cases to the test suite.While the current test cases cover the main scenarios, consider adding:
- Multi-line string credentials
- Credentials with special characters
- Base64 encoded credentials
- Template string credentials
invalid: # Existing cases... + - | + require 'octokit' + token = <<~EOF + abcdef1234567890 + EOF + Octokit::Client.new(access_token: token) + - | + require 'octokit' + Octokit::Client.new(access_token: Base64.encode64('secret'))tests/__snapshots__/ruby-octokit-hardcoded-secret-ruby-snapshot.yml (1)
7-8: Enhance style labels for better clarity.Consider using more descriptive style labels to indicate the purpose of each section:
- 'primary' → 'violation_pattern'
- 'secondary' → 'context_info'
: labels: - source: 'Octokit::Client.new(access_token: "<your 40 char token>", per_page: 100)' - style: primary + style: violation_patternAlso applies to: 118-123
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
rules/python/security/python-psycopg2-hardcoded-secret-python.yml(1 hunks)rules/ruby/security/ruby-excon-hardcoded-secret-ruby.yml(1 hunks)rules/ruby/security/ruby-octokit-hardcoded-secret-ruby.yml(1 hunks)tests/__snapshots__/python-psycopg2-hardcoded-secret-python-snapshot.yml(1 hunks)tests/__snapshots__/ruby-excon-hardcoded-secret-ruby-snapshot.yml(1 hunks)tests/__snapshots__/ruby-octokit-hardcoded-secret-ruby-snapshot.yml(1 hunks)tests/python/python-psycopg2-hardcoded-secret-python-test.yml(1 hunks)tests/ruby/ruby-excon-hardcoded-secret-ruby-test.yml(1 hunks)tests/ruby/ruby-octokit-hardcoded-secret-ruby-test.yml(1 hunks)
🧰 Additional context used
🪛 yamllint (1.35.1)
rules/ruby/security/ruby-excon-hardcoded-secret-ruby.yml
[warning] 17-17: wrong indentation: expected 2 but found 5
(indentation)
[warning] 24-24: wrong indentation: expected 8 but found 11
(indentation)
[warning] 27-27: wrong indentation: expected 8 but found 11
(indentation)
[error] 31-31: trailing spaces
(trailing-spaces)
[error] 39-39: trailing spaces
(trailing-spaces)
[warning] 42-42: wrong indentation: expected 12 but found 14
(indentation)
[warning] 45-45: wrong indentation: expected 15 but found 17
(indentation)
[warning] 48-48: wrong indentation: expected 8 but found 10
(indentation)
[warning] 51-51: wrong indentation: expected 11 but found 13
(indentation)
[warning] 56-56: wrong indentation: expected 2 but found 5
(indentation)
[warning] 63-63: wrong indentation: expected 8 but found 11
(indentation)
[warning] 66-66: wrong indentation: expected 8 but found 11
(indentation)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 78-78: trailing spaces
(trailing-spaces)
[warning] 81-81: wrong indentation: expected 12 but found 14
(indentation)
[warning] 88-88: wrong indentation: expected 9 but found 11
(indentation)
[warning] 91-91: wrong indentation: expected 11 but found 14
(indentation)
[warning] 92-92: wrong indentation: expected 17 but found 19
(indentation)
[warning] 96-96: wrong indentation: expected 17 but found 19
(indentation)
[warning] 99-99: wrong indentation: expected 20 but found 22
(indentation)
[warning] 102-102: wrong indentation: expected 8 but found 10
(indentation)
[warning] 105-105: wrong indentation: expected 11 but found 13
(indentation)
[warning] 110-110: wrong indentation: expected 2 but found 3
(indentation)
[warning] 112-112: wrong indentation: expected 3 but found 5
(indentation)
[warning] 117-117: wrong indentation: expected 8 but found 11
(indentation)
[warning] 120-120: wrong indentation: expected 8 but found 11
(indentation)
[error] 124-124: trailing spaces
(trailing-spaces)
[error] 132-132: trailing spaces
(trailing-spaces)
[warning] 135-135: wrong indentation: expected 12 but found 14
(indentation)
[warning] 138-138: wrong indentation: expected 14 but found 17
(indentation)
[warning] 139-139: wrong indentation: expected 20 but found 22
(indentation)
[warning] 143-143: wrong indentation: expected 20 but found 22
(indentation)
[warning] 146-146: wrong indentation: expected 20 but found 22
(indentation)
[warning] 150-150: wrong indentation: expected 20 but found 22
(indentation)
[warning] 153-153: wrong indentation: expected 23 but found 25
(indentation)
[warning] 156-156: wrong indentation: expected 26 but found 28
(indentation)
[warning] 159-159: wrong indentation: expected 8 but found 10
(indentation)
[warning] 162-162: wrong indentation: expected 11 but found 13
(indentation)
[warning] 167-167: wrong indentation: expected 2 but found 3
(indentation)
[warning] 169-169: wrong indentation: expected 3 but found 5
(indentation)
[warning] 174-174: wrong indentation: expected 8 but found 11
(indentation)
[warning] 177-177: wrong indentation: expected 8 but found 11
(indentation)
[error] 181-181: trailing spaces
(trailing-spaces)
[error] 189-189: trailing spaces
(trailing-spaces)
[warning] 192-192: wrong indentation: expected 12 but found 14
(indentation)
[warning] 195-195: wrong indentation: expected 14 but found 17
(indentation)
[warning] 196-196: wrong indentation: expected 20 but found 22
(indentation)
[warning] 200-200: wrong indentation: expected 20 but found 22
(indentation)
[warning] 203-203: wrong indentation: expected 20 but found 22
(indentation)
[warning] 207-207: wrong indentation: expected 20 but found 22
(indentation)
[warning] 210-210: wrong indentation: expected 23 but found 25
(indentation)
[warning] 214-214: wrong indentation: expected 8 but found 10
(indentation)
[warning] 217-217: wrong indentation: expected 11 but found 13
(indentation)
[warning] 221-221: wrong indentation: expected 8 but found 10
(indentation)
[warning] 227-227: wrong indentation: expected 11 but found 14
(indentation)
[warning] 228-228: wrong indentation: expected 17 but found 19
(indentation)
[warning] 232-232: wrong indentation: expected 17 but found 19
(indentation)
[warning] 235-235: wrong indentation: expected 20 but found 22
(indentation)
[error] 237-237: trailing spaces
(trailing-spaces)
[warning] 239-239: wrong indentation: expected 1 but found 4
(indentation)
[warning] 241-241: wrong indentation: expected 4 but found 8
(indentation)
🔇 Additional comments (8)
tests/__snapshots__/python-psycopg2-hardcoded-secret-python-snapshot.yml (1)
59-87: LGTM! Label positions are accurate for the second test case.
The label positions and styles are well-defined for the direct string password case.
tests/ruby/ruby-excon-hardcoded-secret-ruby-test.yml (1)
7-16: LGTM! Comprehensive coverage of insecure patterns
The invalid test cases effectively cover various patterns of hardcoded secrets:
- Variable assignment of hardcoded password
- Usage of
escape_uriwith hardcoded password - Direct usage of hardcoded password
tests/__snapshots__/ruby-excon-hardcoded-secret-ruby-snapshot.yml (1)
1-190: LGTM! Well-structured snapshots for AST matching
The snapshots provide comprehensive coverage of the code patterns with detailed labeling for accurate AST matching.
rules/ruby/security/ruby-excon-hardcoded-secret-ruby.yml (2)
1-14: LGTM! Clear security guidance and references
The message and note sections effectively communicate:
- The risks of hardcoded secrets
- Best practices for secure credential management
- Relevant CWE and OWASP references
238-244: LGTM! Comprehensive pattern matching
The rule effectively captures various patterns of hardcoded secrets:
- Direct password usage
- Variable-based password usage
- Escaped URI password usage
🧰 Tools
🪛 yamllint (1.35.1)
[warning] 239-239: wrong indentation: expected 1 but found 4
(indentation)
[warning] 241-241: wrong indentation: expected 4 but found 8
(indentation)
rules/ruby/security/ruby-octokit-hardcoded-secret-ruby.yml (1)
38-39: Verify pattern coverage for all credential parameters.
The regex pattern correctly covers the main credential parameters. Let's verify if there are any other credential-related parameters in the Octokit client.
✅ Verification successful
Pattern coverage for credential parameters is comprehensive
Based on the test cases and rule implementation, the current regex pattern ^:password|:access_token|:client_secret|password|access_token|client_secret$ correctly covers all authentication methods used in Octokit::Client:
- Basic authentication (
:password) - OAuth access token (
:access_token) - OAuth application credentials (
:client_secret)
The test cases demonstrate various real-world usage patterns including both symbol and string forms of these parameters, multiline declarations, and different authentication methods.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Search for Octokit::Client initialization patterns in the codebase
# to ensure we haven't missed any credential-related parameters
# Look for Client.new method calls
ast-grep --pattern 'Octokit::Client.new($_)'
# Search for documentation or examples mentioning authentication
rg -i "auth|cred|token|secret" --type ruby
Length of output: 240
Script:
#!/bin/bash
# Let's search for any Ruby files in the repository first
fd -e rb
# Then let's look at the content of the rule file itself to understand the context better
cat rules/ruby/security/ruby-octokit-hardcoded-secret-ruby.yml
# Let's also search for any other YAML files that might contain similar patterns
fd -e yml -e yaml | xargs grep -l -i "octokit"
Length of output: 3296
Script:
#!/bin/bash
# Let's check the test file to see what patterns are being tested
cat tests/ruby/ruby-octokit-hardcoded-secret-ruby-test.yml
# And check the snapshot file for any additional context
cat tests/__snapshots__/ruby-octokit-hardcoded-secret-ruby-snapshot.yml
Length of output: 7298
tests/ruby/ruby-octokit-hardcoded-secret-ruby-test.yml (1)
2-5: LGTM: Valid test case demonstrates best practice.
The valid test case correctly demonstrates using a variable for the access token instead of a hard-coded value.
tests/__snapshots__/ruby-octokit-hardcoded-secret-ruby-snapshot.yml (1)
1-270: LGTM: Snapshot structure is comprehensive.
The snapshots provide detailed source mapping and properly capture all test cases.
Summary by CodeRabbit
New Features
psycopg2, and Ruby applications usingExconandOctokit.Bug Fixes
Tests