Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add security rules for detecting hard-coded secrets in C# and Python #101

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

ESS-ENN
Copy link
Collaborator

@ESS-ENN ESS-ENN commented Dec 11, 2024

Summary by CodeRabbit

  • New Features

    • Introduced new security rules for detecting hard-coded secrets in C# and Python applications.
    • Added validation rules and test cases to enforce best practices for credential management in database connections.
  • Tests

    • Created snapshot files for various database connection scenarios using hard-coded secrets.
    • Added test configurations to validate correct and incorrect practices related to hard-coded credentials in both C# and Python.

@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


Sakshis seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

Copy link

coderabbitai bot commented Dec 11, 2024

Walkthrough

This pull request introduces new security rules for detecting hard-coded secrets in C# and Python applications. Specifically, it adds rules targeting the NpgsqlConnectionStringBuilder and Peewee ORM in C#, and the pg8000 library in Python. Each rule identifies instances of hard-coded passwords and provides guidance for secure credential management. Additionally, various test cases and snapshots are included to validate the implementation of these rules and demonstrate both valid and invalid usage patterns related to hard-coded secrets.

Changes

File Change Summary
rules/csharp/security/npgsqlconnectionstringbuilder-hardcoded-secret-csharp.yml New rule added: npgsqlconnectionstringbuilder-hardcoded-secret-csharp to detect hard-coded secrets in C#.
rules/python/security/python-peewee-pg-hardcoded-secret-python.yml New rule added: python-peewee-pg-hardcoded-secret-python to identify hard-coded secrets in Peewee ORM.
rules/python/security/python-pg8000-hardcoded-secret-python.yml New rule added: python-pg8000-hardcoded-secret-python to flag empty passwords in pg8000 database connections.
tests/__snapshots__/npgsqlconnectionstringbuilder-hardcoded-secret-csharp-snapshot.yml Snapshot added to demonstrate various usages of NpgsqlConnectionStringBuilder with hard-coded secrets.
tests/__snapshots__/python-peewee-pg-hardcoded-secret-python-snapshot.yml Snapshot added for testing hard-coded secrets in Peewee database initialization.
tests/__snapshots__/python-pg8000-hardcoded-secret-python-snapshot.yml Snapshot added showing different methods of connecting to PostgreSQL using pg8000 with hard-coded passwords.
tests/csharp/npgsqlconnectionstringbuilder-hardcoded-secret-csharp-test.yml New test cases added for valid and invalid usages of NpgsqlConnectionStringBuilder.
tests/python/python-peewee-pg-hardcoded-secret-python-test.yml New test cases added for valid and invalid configurations in Peewee database connections.
tests/python/python-pg8000-hardcoded-secret-python-test.yml New test cases added for validating the use of hard-coded secrets in pg8000 database connections.

Possibly related PRs

Suggested reviewers

  • harjotgill

Poem

🐇 In the code where secrets hide,
A rabbit hops with eyes so wide.
"No more passwords hard-coded tight,
Use vaults and vars, keep them out of sight!"
With rules in place, we’ll code with care,
Security blooms, a safe software lair! 🌟


🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR. (Experiment)
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@coderabbitai coderabbitai bot changed the title @coderabbitai Add security rules for detecting hard-coded secrets in C# and Python Dec 11, 2024
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Outside diff range and nitpick comments (8)
rules/csharp/security/npgsqlconnectionstringbuilder-hardcoded-secret-csharp.yml (1)

242-246: Consider extending the rule to cover additional scenarios.

The rule effectively catches direct assignments and indexer access but might miss other scenarios:

  1. Constructor parameter assignments
  2. Builder pattern assignments
  3. Connection string parsing

Would you like me to provide patterns for these additional scenarios?

tests/csharp/npgsqlconnectionstringbuilder-hardcoded-secret-csharp-test.yml (1)

48-48: Remove trailing whitespace.

Line 48 contains trailing spaces.

-    string password = "aaa";  
+    string password = "aaa";
🧰 Tools
🪛 yamllint (1.35.1)

[error] 48-48: trailing spaces

(trailing-spaces)

tests/python/python-peewee-pg-hardcoded-secret-python-test.yml (1)

5-24: Enhance test coverage

The invalid test cases don't cover all database classes mentioned in the rule. Consider adding test cases for:

  • peewee.PostgresqlDatabase
  • playhouse.postgres_ext.PostgresqlExtDatabase
  • playhouse.pool.PooledPostgresqlDatabase
  • playhouse.cockroachdb.CockroachDatabase
rules/python/security/python-peewee-pg-hardcoded-secret-python.yml (3)

4-13: Enhance the security message

Consider adding more context to the message:

  1. Mention specific alternatives (e.g., AWS Secrets Manager, HashiCorp Vault)
  2. Add examples of secure usage
  3. Reference database-specific security documentation

14-202: Improve rule maintainability

The rule patterns contain duplicated regex patterns for database classes. Consider extracting common patterns into reusable variables.

+variables:
+  $DB_CLASSES: ^PostgresqlDatabase|peewee.PostgresqlDatabase|PostgresqlExtDatabase|playhouse.postgres_ext.PostgresqlExtDatabase|PooledPostgresqlDatabase|playhouse.pool.PooledPostgresqlDatabase|CockroachDatabase|playhouse.cockroachdb.CockroachDatabase|PooledCockroachDatabase|playhouse.cockroachdb.PooledCockroachDatabase$
 utils:
   $DB(..., password="...",...):
     kind: call
     all:
     - has:
         stopBy: neighbor
         pattern: $DB
-        regex: ^PostgresqlDatabase|peewee.PostgresqlDatabase|PostgresqlExtDatabase|playhouse.postgres_ext.PostgresqlExtDatabase|PooledPostgresqlDatabase|playhouse.pool.PooledPostgresqlDatabase|CockroachDatabase|playhouse.cockroachdb.CockroachDatabase|PooledCockroachDatabase|playhouse.cockroachdb.PooledCockroachDatabase$
+        regex: $DB_CLASSES
🧰 Tools
🪛 yamllint (1.35.1)

[warning] 30-30: wrong indentation: expected 10 but found 12

(indentation)


[warning] 38-38: wrong indentation: expected 18 but found 19

(indentation)


[warning] 55-55: wrong indentation: expected 10 but found 12

(indentation)


[error] 67-67: trailing spaces

(trailing-spaces)


[warning] 71-71: wrong indentation: expected 12 but found 14

(indentation)


[warning] 74-74: wrong indentation: expected 14 but found 16

(indentation)


[warning] 82-82: wrong indentation: expected 22 but found 23

(indentation)


[warning] 92-92: wrong indentation: expected 8 but found 10

(indentation)


[warning] 107-107: wrong indentation: expected 10 but found 12

(indentation)


[warning] 115-115: wrong indentation: expected 18 but found 19

(indentation)


[warning] 127-127: wrong indentation: expected 12 but found 14

(indentation)


[warning] 142-142: wrong indentation: expected 8 but found 10

(indentation)


[warning] 157-157: wrong indentation: expected 10 but found 12

(indentation)


[warning] 176-176: wrong indentation: expected 12 but found 14

(indentation)


[error] 186-186: trailing spaces

(trailing-spaces)


[warning] 190-190: wrong indentation: expected 12 but found 14

(indentation)


[warning] 193-193: wrong indentation: expected 14 but found 16

(indentation)


[warning] 201-201: wrong indentation: expected 22 but found 23

(indentation)


1-209: Fix YAML indentation issues

The file contains multiple indentation inconsistencies. Please fix the indentation to follow YAML best practices.

🧰 Tools
🪛 yamllint (1.35.1)

[warning] 30-30: wrong indentation: expected 10 but found 12

(indentation)


[warning] 38-38: wrong indentation: expected 18 but found 19

(indentation)


[warning] 55-55: wrong indentation: expected 10 but found 12

(indentation)


[error] 67-67: trailing spaces

(trailing-spaces)


[warning] 71-71: wrong indentation: expected 12 but found 14

(indentation)


[warning] 74-74: wrong indentation: expected 14 but found 16

(indentation)


[warning] 82-82: wrong indentation: expected 22 but found 23

(indentation)


[warning] 92-92: wrong indentation: expected 8 but found 10

(indentation)


[warning] 107-107: wrong indentation: expected 10 but found 12

(indentation)


[warning] 115-115: wrong indentation: expected 18 but found 19

(indentation)


[warning] 127-127: wrong indentation: expected 12 but found 14

(indentation)


[warning] 142-142: wrong indentation: expected 8 but found 10

(indentation)


[warning] 157-157: wrong indentation: expected 10 but found 12

(indentation)


[warning] 176-176: wrong indentation: expected 12 but found 14

(indentation)


[error] 186-186: trailing spaces

(trailing-spaces)


[warning] 190-190: wrong indentation: expected 12 but found 14

(indentation)


[warning] 193-193: wrong indentation: expected 14 but found 16

(indentation)


[warning] 201-201: wrong indentation: expected 22 but found 23

(indentation)


[warning] 206-206: wrong indentation: expected 2 but found 4

(indentation)

tests/__snapshots__/python-pg8000-hardcoded-secret-python-snapshot.yml (1)

1-214: LGTM! Well-structured snapshots with precise labeling.

The snapshots effectively capture all test cases with detailed position information and style markers.

Consider fixing the YAML indentation issues flagged by yamllint for better maintainability.

rules/python/security/python-pg8000-hardcoded-secret-python.yml (1)

4-14: LGTM! Clear message with proper security context.

The message and documentation effectively:

  • Explain the security risk
  • Provide mitigation strategies
  • Include relevant CWE reference
  • Link to OWASP guidelines

Consider adding code examples in the documentation to illustrate both the vulnerable and secure patterns.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Reviewing files that changed from the base of the PR and between 2f95a8e and 51a2d30.

📒 Files selected for processing (9)
  • rules/csharp/security/npgsqlconnectionstringbuilder-hardcoded-secret-csharp.yml (1 hunks)
  • rules/python/security/python-peewee-pg-hardcoded-secret-python.yml (1 hunks)
  • rules/python/security/python-pg8000-hardcoded-secret-python.yml (1 hunks)
  • tests/__snapshots__/npgsqlconnectionstringbuilder-hardcoded-secret-csharp-snapshot.yml (1 hunks)
  • tests/__snapshots__/python-peewee-pg-hardcoded-secret-python-snapshot.yml (1 hunks)
  • tests/__snapshots__/python-pg8000-hardcoded-secret-python-snapshot.yml (1 hunks)
  • tests/csharp/npgsqlconnectionstringbuilder-hardcoded-secret-csharp-test.yml (1 hunks)
  • tests/python/python-peewee-pg-hardcoded-secret-python-test.yml (1 hunks)
  • tests/python/python-pg8000-hardcoded-secret-python-test.yml (1 hunks)
🧰 Additional context used
🪛 yamllint (1.35.1)
tests/csharp/npgsqlconnectionstringbuilder-hardcoded-secret-csharp-test.yml

[error] 48-48: trailing spaces

(trailing-spaces)

rules/python/security/python-pg8000-hardcoded-secret-python.yml

[warning] 31-31: wrong indentation: expected 10 but found 12

(indentation)


[warning] 39-39: wrong indentation: expected 18 but found 19

(indentation)


[warning] 56-56: wrong indentation: expected 10 but found 12

(indentation)


[error] 68-68: trailing spaces

(trailing-spaces)


[warning] 72-72: wrong indentation: expected 12 but found 14

(indentation)


[warning] 75-75: wrong indentation: expected 14 but found 16

(indentation)


[warning] 83-83: wrong indentation: expected 22 but found 23

(indentation)


[warning] 100-100: wrong indentation: expected 10 but found 12

(indentation)


[warning] 108-108: wrong indentation: expected 18 but found 19

(indentation)


[warning] 115-115: wrong indentation: expected 12 but found 11

(indentation)


[warning] 118-118: wrong indentation: expected 11 but found 12

(indentation)


[warning] 135-135: wrong indentation: expected 10 but found 12

(indentation)


[warning] 151-151: wrong indentation: expected 10 but found 12

(indentation)


[warning] 163-163: wrong indentation: expected 12 but found 14

(indentation)


[warning] 181-181: wrong indentation: expected 8 but found 10

(indentation)


[warning] 197-197: wrong indentation: expected 10 but found 12

(indentation)


[warning] 216-216: wrong indentation: expected 12 but found 14

(indentation)


[warning] 234-234: wrong indentation: expected 12 but found 14

(indentation)


[warning] 247-247: wrong indentation: expected 2 but found 4

(indentation)

rules/python/security/python-peewee-pg-hardcoded-secret-python.yml

[warning] 30-30: wrong indentation: expected 10 but found 12

(indentation)


[warning] 38-38: wrong indentation: expected 18 but found 19

(indentation)


[warning] 55-55: wrong indentation: expected 10 but found 12

(indentation)


[error] 67-67: trailing spaces

(trailing-spaces)


[warning] 71-71: wrong indentation: expected 12 but found 14

(indentation)


[warning] 74-74: wrong indentation: expected 14 but found 16

(indentation)


[warning] 82-82: wrong indentation: expected 22 but found 23

(indentation)


[warning] 92-92: wrong indentation: expected 8 but found 10

(indentation)


[warning] 107-107: wrong indentation: expected 10 but found 12

(indentation)


[warning] 115-115: wrong indentation: expected 18 but found 19

(indentation)


[warning] 127-127: wrong indentation: expected 12 but found 14

(indentation)


[warning] 142-142: wrong indentation: expected 8 but found 10

(indentation)


[warning] 157-157: wrong indentation: expected 10 but found 12

(indentation)


[warning] 176-176: wrong indentation: expected 12 but found 14

(indentation)


[error] 186-186: trailing spaces

(trailing-spaces)


[warning] 190-190: wrong indentation: expected 12 but found 14

(indentation)


[warning] 193-193: wrong indentation: expected 14 but found 16

(indentation)


[warning] 201-201: wrong indentation: expected 22 but found 23

(indentation)


[warning] 206-206: wrong indentation: expected 2 but found 4

(indentation)

🔇 Additional comments (10)
rules/csharp/security/npgsqlconnectionstringbuilder-hardcoded-secret-csharp.yml (2)

1-14: LGTM! Well-documented security rule with proper references.

The rule is well-documented with clear messaging and appropriate references to security standards (CWE-798, OWASP A07:2021).


100-108: ⚠️ Potential issue

Fix nested 'all' block in match_assignment_with_bracket pattern.

The nested 'all' block at line 100 appears to be misplaced and might affect pattern matching.

Apply this diff to fix the pattern:

              all:
-                - not:
-                    precedes:
-                      stopBy: end
-                      kind: element_access_expression
-                - not:
-                    precedes:
-                      stopBy: end
-                      kind: identifier
+      - not:
+          precedes:
+            stopBy: end
+            kind: element_access_expression
+      - not:
+          precedes:
+            stopBy: end
+            kind: identifier

Likely invalid or redundant comment.

tests/csharp/npgsqlconnectionstringbuilder-hardcoded-secret-csharp-test.yml (2)

2-6: LGTM! Comprehensive valid test cases.

The valid test cases properly demonstrate secure password handling using command-line arguments.


8-52: LGTM! Well-structured invalid test cases.

The invalid test cases effectively cover different patterns of hardcoded secrets:

  1. Direct property assignment
  2. Indexer access
  3. Variable-based assignment
🧰 Tools
🪛 yamllint (1.35.1)

[error] 48-48: trailing spaces

(trailing-spaces)

tests/__snapshots__/npgsqlconnectionstringbuilder-hardcoded-secret-csharp-snapshot.yml (1)

1-264: LGTM! Well-structured snapshots with comprehensive labels.

The snapshots provide good coverage of the test cases and effectively identify key components through labels.

tests/__snapshots__/python-peewee-pg-hardcoded-secret-python-snapshot.yml (1)

1-340: LGTM! Comprehensive test coverage

The snapshots provide thorough coverage of the rule patterns and include detailed source mapping for accurate testing.

tests/python/python-pg8000-hardcoded-secret-python-test.yml (2)

3-5: LGTM! Valid test case demonstrates secure password management.

The test case correctly shows the recommended approach of using a function to retrieve the password dynamically rather than hardcoding it.


6-20: LGTM! Comprehensive coverage of insecure patterns.

The invalid test cases effectively cover various scenarios:

  • Direct password hardcoding in connection string
  • Password stored in variables
  • Different import styles (native and dbapi)
  • Different connection methods
rules/python/security/python-pg8000-hardcoded-secret-python.yml (2)

245-251: LGTM! Well-structured rule composition.

The rule effectively combines all pattern matchers using the 'any' condition, ensuring comprehensive coverage of different hardcoded secret patterns.

🧰 Tools
🪛 yamllint (1.35.1)

[warning] 247-247: wrong indentation: expected 2 but found 4

(indentation)


15-244: LGTM! Comprehensive pattern matching for detecting hardcoded secrets.

The rule effectively covers:

  • Direct string passwords in connection calls
  • Variable-based password assignments
  • Different import patterns (dbapi and native)
  • Various connection method styles

Let's verify the pattern coverage against the codebase:

🧰 Tools
🪛 yamllint (1.35.1)

[warning] 31-31: wrong indentation: expected 10 but found 12

(indentation)


[warning] 39-39: wrong indentation: expected 18 but found 19

(indentation)


[warning] 56-56: wrong indentation: expected 10 but found 12

(indentation)


[error] 68-68: trailing spaces

(trailing-spaces)


[warning] 72-72: wrong indentation: expected 12 but found 14

(indentation)


[warning] 75-75: wrong indentation: expected 14 but found 16

(indentation)


[warning] 83-83: wrong indentation: expected 22 but found 23

(indentation)


[warning] 100-100: wrong indentation: expected 10 but found 12

(indentation)


[warning] 108-108: wrong indentation: expected 18 but found 19

(indentation)


[warning] 115-115: wrong indentation: expected 12 but found 11

(indentation)


[warning] 118-118: wrong indentation: expected 11 but found 12

(indentation)


[warning] 135-135: wrong indentation: expected 10 but found 12

(indentation)


[warning] 151-151: wrong indentation: expected 10 but found 12

(indentation)


[warning] 163-163: wrong indentation: expected 12 but found 14

(indentation)


[warning] 181-181: wrong indentation: expected 8 but found 10

(indentation)


[warning] 197-197: wrong indentation: expected 10 but found 12

(indentation)


[warning] 216-216: wrong indentation: expected 12 but found 14

(indentation)


[warning] 234-234: wrong indentation: expected 12 but found 14

(indentation)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants