Skip to content

Commit 46a8be9

Browse files
loris-s-sonarsourceloris-s-sonarsource
authored
Create S6783: Infura API keys should not be disclosed (#278)
1 parent 2043337 commit 46a8be9

File tree

9 files changed

+211
-4
lines changed

9 files changed

+211
-4
lines changed

‎sonar-text-plugin/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@
116116
<configuration>
117117
<rules>
118118
<requireFilesSize>
119-
<maxsize>3150000</maxsize>
119+
<maxsize>3250000</maxsize>
120120
<minsize>2950000</minsize>
121121
<files>
122122
<file>${project.build.directory}/${project.build.finalName}.jar</file>

‎sonar-text-plugin/src/main/java/org/sonar/plugins/secrets/SecretsRulesDefinition.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
import org.sonar.plugins.secrets.checks.GrafanaCheck;
4848
import org.sonar.plugins.secrets.checks.HashicorpCheck;
4949
import org.sonar.plugins.secrets.checks.IbmApiKeyCheck;
50+
import org.sonar.plugins.secrets.checks.InfuraApiKeyCheck;
5051
import org.sonar.plugins.secrets.checks.JFrogCheck;
5152
import org.sonar.plugins.secrets.checks.MailgunCheck;
5253
import org.sonar.plugins.secrets.checks.MicrosoftTeamsWebhookUrlCheck;
@@ -124,6 +125,7 @@ public static List<Class<?>> checks() {
124125
GrafanaCheck.class,
125126
HashicorpCheck.class,
126127
IbmApiKeyCheck.class,
128+
InfuraApiKeyCheck.class,
127129
JFrogCheck.class,
128130
MailgunCheck.class,
129131
MicrosoftTeamsWebhookUrlCheck.class,
@@ -156,8 +158,8 @@ public static List<Class<?>> checks() {
156158
TypeformCheck.class,
157159
WakaTimeCheck.class,
158160
WeChatCheck.class,
159-
ZuploCheck.class,
160161
YandexCheck.class,
161-
ZapierWebhookUrlCheck.class);
162+
ZapierWebhookUrlCheck.class,
163+
ZuploCheck.class);
162164
}
163165
}

‎sonar-text-plugin/src/main/java/org/sonar/plugins/secrets/SecretsSpecificationFilesDefinition.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ public static Set<String> existingSecretSpecifications() {
5252
"grafana.yaml",
5353
"hashicorp.yaml",
5454
"ibm.yaml",
55+
"infura.yaml",
5556
"mailgun.yaml",
5657
"mongodb.yaml",
5758
"ms-teams.yaml",

‎sonar-text-plugin/src/main/java/org/sonar/plugins/secrets/checks/InfuraApiKeyCheck.java

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
* SonarQube Text Plugin
3+
* Copyright (C) 2021-2023 SonarSource SA
4+
* mailto:info AT sonarsource DOT com
5+
*
6+
* This program is free software; you can redistribute it and/or
7+
* modify it under the terms of the GNU Lesser General Public
8+
* License as published by the Free Software Foundation; either
9+
* version 3 of the License, or (at your option) any later version.
10+
*
11+
* This program is distributed in the hope that it will be useful,
12+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
13+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14+
* Lesser General Public License for more details.
15+
*
16+
* You should have received a copy of the GNU Lesser General Public License
17+
* along with this program; if not, write to the Free Software Foundation,
18+
* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
19+
*/
20+
package org.sonar.plugins.secrets.checks;
21+
22+
import org.sonar.check.Rule;
23+
import org.sonar.plugins.secrets.api.SpecificationBasedCheck;
24+
25+
@Rule(key = "S6783")
26+
public class InfuraApiKeyCheck extends SpecificationBasedCheck {
27+
}

‎sonar-text-plugin/src/main/resources/org/sonar/l10n/secrets/rules/secrets/S6783.html

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<p>Secret leaks often occur when a sensitive piece of authentication data is stored with the source code of an application. Considering the source
2+
code is intended to be deployed across multiple assets, including source code repositories or application hosting servers, the secrets might get
3+
exposed to an unintended audience.</p>
4+
<h2>Why is this an issue?</h2>
5+
<p>In most cases, trust boundaries are violated when a secret is exposed in a source code repository or an uncontrolled deployment environment.
6+
Unintended people who don’t need to know the secret might get access to it. They might then be able to use it to gain unwanted access to associated
7+
services or resources.</p>
8+
<p>The trust issue can be more or less severe depending on the people’s role and entitlement.</p>
9+
<h3>What is the potential impact?</h3>
10+
<p>Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the secret.</p>
11+
<h4>Disclosure of blockchain data</h4>
12+
<p>The leaked key can be used to query APIs of blockchain services and access sensitive information stored in the service metadata. This may include
13+
user identities and other sensitive data.<br> Such disclosure compromises user privacy and confidentiality.</p>
14+
<h4>Breach of trust in non-repudiation and disruption of the audit trail</h4>
15+
<p>When such a secret is compromised, malicious actors might have the possibility to send malicious event objects, causing discrepancies in the audit
16+
trail. This can make it difficult to trace and verify the sequence of events, impacting the ability to investigate and identify unauthorized or
17+
fraudulent activity.</p>
18+
<p>All in all, this can lead to problems in proving the validity of transactions or actions performed, potentially leading to disputes and legal
19+
complications.</p>
20+
<h4>Financial loss</h4>
21+
<p>Since this secret is used to process transaction-related operations, financial loss may also occur if transaction-related objects are corrupted or
22+
the account is tampered with.<br> This can range from indirect losses to direct unauthorized transfers of funds that can lead to bankruptcy or
23+
impoverishment of individuals.</p>
24+
<h2>How to fix it</h2>
25+
<p><strong>Revoke the secret</strong></p>
26+
<p>Revoke any leaked secrets and remove them from the application source code.</p>
27+
<p>Before revoking the secret, ensure that no other applications or processes are using it. Other usages of the secret will also be impacted when the
28+
secret is revoked.</p>
29+
<p><strong>Use a secret vault</strong></p>
30+
<p>A secret vault should be used to generate and store the new secret. This will ensure the secret’s security and prevent any further unexpected
31+
disclosure.</p>
32+
<p>Depending on the development platform and the leaked secret type, multiple solutions are currently available.</p>
33+
<h3>Code examples</h3>
34+
<h4>Noncompliant code example</h4>
35+
<pre data-diff-id="1" data-diff-type="noncompliant">
36+
props.set("infura_api_key", "https://mainnet.infura.io/v3/f6fc4aa25abb16e901876269d01f2ec5")
37+
</pre>
38+
<h4>Compliant solution</h4>
39+
<pre data-diff-id="1" data-diff-type="compliant">
40+
props.set("infura_api_key", System.getenv("INFURA_API_KEY"))
41+
</pre>
42+
<h2>Resources</h2>
43+
<h3>Standards</h3>
44+
<ul>
45+
<li> MITRE - <a href="https://cwe.mitre.org/data/definitions/798">CWE-798 - Use of Hard-coded Credentials</a> </li>
46+
<li> MITRE - <a href="https://cwe.mitre.org/data/definitions/259">CWE-259 - Use of Hard-coded Password</a> </li>
47+
<li> SANS - <a href="https://www.sans.org/top25-software-errors/#cat3">TOP 25 Most Dangerous Software Errors</a> </li>
48+
</ul>
49+

‎sonar-text-plugin/src/main/resources/org/sonar/l10n/secrets/rules/secrets/S6783.json

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"title": "Infura API keys should not be disclosed",
3+
"type": "VULNERABILITY",
4+
"code": {
5+
"impacts": {
6+
"SECURITY": "HIGH"
7+
},
8+
"attribute": "TRUSTWORTHY"
9+
},
10+
"status": "ready",
11+
"remediation": {
12+
"func": "Constant\/Issue",
13+
"constantCost": "30min"
14+
},
15+
"tags": [
16+
"cwe"
17+
],
18+
"defaultSeverity": "Blocker",
19+
"ruleSpecification": "RSPEC-6783",
20+
"sqKey": "S6783",
21+
"scope": "All",
22+
"securityStandards": {
23+
"CWE": [
24+
798,
25+
259
26+
],
27+
"OWASP": [
28+
"A3"
29+
],
30+
"CERT": [
31+
"MSC03-J."
32+
],
33+
"OWASP Top 10 2021": [
34+
"A7"
35+
],
36+
"PCI DSS 3.2": [
37+
"6.5.10"
38+
],
39+
"PCI DSS 4.0": [
40+
"6.2.4"
41+
],
42+
"ASVS 4.0": [
43+
"2.10.4",
44+
"3.5.2",
45+
"6.4.1"
46+
]
47+
},
48+
"quickfix": "unknown"
49+
}

‎sonar-text-plugin/src/main/resources/org/sonar/l10n/secrets/rules/secrets/Sonar_way_profile.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@
5959
"S6771",
6060
"S6773",
6161
"S6777",
62-
"S6782"
62+
"S6782",
63+
"S6783"
6364
]
6465
}

‎sonar-text-plugin/src/main/resources/org/sonar/plugins/secrets/configuration/infura.yaml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
provider:
2+
metadata:
3+
name: Infura Api Key
4+
category: Blockchain API
5+
message: Make sure this Infura API key gets revoked, changed, and removed from the code.
6+
detection:
7+
pre:
8+
include:
9+
content:
10+
- "infura.io/v3"
11+
post:
12+
patternNot:
13+
- "(\\w)\\1{7,}"
14+
15+
rules:
16+
- rspecKey: S6783
17+
id: infura-api-keys
18+
metadata:
19+
name: Infura Api Keys
20+
detection:
21+
matching:
22+
pattern: "\\.infura\\.io/v3/([\\w]{32})"
23+
examples:
24+
- text: |
25+
# Noncompliant code example
26+
props.set("infura_api_key", "https://mainnet.infura.io/v3/f6fc4aa25abb16e901876269d01f2ec5")
27+
containsSecret: true
28+
match: f6fc4aa25abb16e901876269d01f2ec5
29+
- text: |
30+
# Compliant solution
31+
props.set("infura_api_key", System.getenv("INFURA_API_KEY"))
32+
containsSecret: false
33+
- text: |
34+
const NETWORKS = {
35+
'1': 'https://mainnet.infura.io/v3/ac08c9ada68044d38f55d4cb4749d54a',
36+
'2': 'wss://mainnet.infura.io/ws/v3/ac08c9ada68044d38f55d4cb4749d54a',
37+
}
38+
containsSecret: true
39+
match: ac08c9ada68044d38f55d4cb4749d54a
40+
- text: |
41+
const NETWORKS = {
42+
'1': 'https://mainnet.infura.io/v3/your-api-key',
43+
}
44+
containsSecret: false
45+
- text: |
46+
const NETWORKS = {
47+
'1': 'https://mainnet.infura.io/v3/{API_KEY}',
48+
}
49+
containsSecret: false
50+

‎sonar-text-plugin/src/test/java/org/sonar/plugins/secrets/checks/InfuraApiKeyCheckTest.java

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/*
2+
* SonarQube Text Plugin
3+
* Copyright (C) 2021-2023 SonarSource SA
4+
* mailto:info AT sonarsource DOT com
5+
*
6+
* This program is free software; you can redistribute it and/or
7+
* modify it under the terms of the GNU Lesser General Public
8+
* License as published by the Free Software Foundation; either
9+
* version 3 of the License, or (at your option) any later version.
10+
*
11+
* This program is distributed in the hope that it will be useful,
12+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
13+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14+
* Lesser General Public License for more details.
15+
*
16+
* You should have received a copy of the GNU Lesser General Public License
17+
* along with this program; if not, write to the Free Software Foundation,
18+
* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
19+
*/
20+
package org.sonar.plugins.secrets.checks;
21+
22+
import org.sonar.plugins.secrets.utils.AbstractRuleExampleTest;
23+
24+
class InfuraApiKeyCheckTest extends AbstractRuleExampleTest {
25+
InfuraApiKeyCheckTest() {
26+
super(new InfuraApiKeyCheck());
27+
}
28+
}

0 commit comments

Comments
 (0)