Skip to content

Commit cc1eac5

Browse files
jonas-wielage-sonarsourcejonas-wielage-sonarsource
authored
Update static rspec files (#283)
1 parent 9cdbc30 commit cc1eac5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+720
-252
lines changed

‎sonar-text-plugin/src/main/resources/org/sonar/l10n/secrets/rules/secrets/S6290.html

Lines changed: 61 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,68 @@
1+
<p>Secret leaks often occur when a sensitive piece of authentication data is stored with the source code of an application. Considering the source
2+
code is intended to be deployed across multiple assets, including source code repositories or application hosting servers, the secrets might get
3+
exposed to an unintended audience.</p>
14
<h2>Why is this an issue?</h2>
2-
<p>AWS credentials are designed to authenticate and authorize requests to AWS.</p>
3-
<p>If your application interacts with AWS then it requires AWS credentials to access all the resources it needs to function properly. Resources that
4-
can be accessed depend on the permission granted to the AWS account. These credentials may authenticate to the AWS account root user who has
5-
unrestricted access to all resources in your AWS account, including billing information.</p>
6-
<p>This rule flags instances of:</p>
5+
<p>In most cases, trust boundaries are violated when a secret is exposed in a source code repository or an uncontrolled deployment environment.
6+
Unintended people who don’t need to know the secret might get access to it. They might then be able to use it to gain unwanted access to associated
7+
services or resources.</p>
8+
<p>The trust issue can be more or less severe depending on the people’s role and entitlement.</p>
9+
<p>This rule detects the following leaks:</p>
710
<ul>
8-
<li> AWS Secret Access Key </li>
9-
<li> AWS Access ID </li>
10-
<li> AWS Session Token </li>
11+
<li> AWS Secret Access Keys </li>
12+
<li> AWS Access IDs </li>
13+
<li> AWS Session Tokens </li>
1114
</ul>
12-
<h2>Recommended Secure Coding Practices</h2>
13-
<p>Only administrators should have access to the AWS credentials used by your application.</p>
14-
<p>As a consequence, AWS credentials should not be stored along with the application code as they would grant special privilege to anyone who has
15-
access to the application source code.</p>
16-
<p>Credentials should be stored outside of the code in a file that is never committed to your application code repository.</p>
17-
<p>If possible, a better alternative is to use your cloud provider’s service for managing secrets. On AWS this service is called <a
18-
href="https://aws.amazon.com/fr/secrets-manager/">Secrets Manager</a>.</p>
19-
<p>When credentials are disclosed in the application code, consider them as compromised and revoke them immediately.</p>
15+
<h3>What is the potential impact?</h3>
16+
<p>Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the secret.</p>
17+
<h4>Phishing and spam</h4>
18+
<p>An attacker can use this secret to spam users or lure them into links to a malicious domain controlled by the attacker.</p>
19+
<p>Spam can cause users to be exposed to the following:</p>
20+
<ul>
21+
<li> Unsolicited, inappropriate content, such as pornographic material </li>
22+
<li> Fraudulent attempts to trick users into sending information or money </li>
23+
<li> Abusive or hateful statements </li>
24+
<li> False advertising or fraudulent claims </li>
25+
</ul>
26+
<p>Once a user has been phished on a legitimate-seeming third-party website, an attacker can collect the user’s credentials, bypass multi-factor
27+
authentication (MFA), and take over the user’s account on the trusted website.</p>
28+
<h4>Malware distribution</h4>
29+
<p>Due to this vulnerability, malware can be stored and spread, both to users of the service and to other potential targets.<br> A malware depends on
30+
the attacker’s intentions, as the following examples show:</p>
31+
<ul>
32+
<li> Cryptojacking malware, whose goal is to "mine" cryptocurrencies on the affected computers or servers. </li>
33+
<li> Spyware that spies out sensitive information from victims. </li>
34+
</ul>
35+
<p>In the worst case, malware can cause the target systems to be completely compromised and allow attackers to infiltrate the systems.</p>
36+
<h4>Financial loss</h4>
37+
<p>Financial losses can occur when a secret is used to access a paid third-party-provided service and is disclosed as part of the source code of
38+
client applications. Having the secret, each user of the application will be able to use it without limit to use the third party service to their own
39+
need, including in a way that was not expected.</p>
40+
<p>This additional use of the secret will lead to added costs with the service provider.</p>
41+
<p>Moreover, when rate or volume limiting is set up on the provider side, this additional use can prevent the regular operation of the affected
42+
application. This might result in a partial denial of service for all the application’s users.</p>
43+
<h2>How to fix it</h2>
44+
<p><strong>Revoke the secret</strong></p>
45+
<p>Revoke any leaked secrets and remove them from the application source code.</p>
46+
<p>Before revoking the secret, ensure that no other applications or processes are using it. Other usages of the secret will also be impacted when the
47+
secret is revoked.</p>
48+
<p><strong>Use a secret vault</strong></p>
49+
<p>A secret vault should be used to generate and store the new secret. This will ensure the secret’s security and prevent any further unexpected
50+
disclosure.</p>
51+
<p>Depending on the development platform and the leaked secret type, multiple solutions are currently available.</p>
52+
<h3>Code examples</h3>
53+
<h4>Noncompliant code example</h4>
54+
<pre data-diff-id="1" data-diff-type="noncompliant">
55+
props.set("aws-secret-access-key", "kHeUAwnSUizTWpSbyGAz4f+As5LshPIjvtpswqGb")
56+
</pre>
57+
<h4>Compliant solution</h4>
58+
<pre data-diff-id="1" data-diff-type="compliant">
59+
props.set("aws-secret-access-key", System.getenv("AWS_SECRET_ACCESS_KEY"))
60+
</pre>
2061
<h2>Resources</h2>
62+
<h3>Standards</h3>
2163
<ul>
22-
<li> <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/">OWASP Top 10 2021 Category A7</a> - Identification and
23-
Authentication Failures </li>
24-
<li> <a href="https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">OWASP Top 10 2017 Category A3</a> - Sensitive Data
25-
Exposure </li>
26-
<li> <a href="https://cwe.mitre.org/data/definitions/798">MITRE, CWE-798</a> - Use of Hard-coded Credentials </li>
27-
<li> <a href="https://cwe.mitre.org/data/definitions/259">MITRE, CWE-259</a> - Use of Hard-coded Password </li>
28-
<li> <a href="https://www.sans.org/top25-software-errors/#cat3">SANS Top 25</a> - Porous Defenses </li>
64+
<li> MITRE - <a href="https://cwe.mitre.org/data/definitions/798">CWE-798 - Use of Hard-coded Credentials</a> </li>
65+
<li> MITRE - <a href="https://cwe.mitre.org/data/definitions/259">CWE-259 - Use of Hard-coded Password</a> </li>
66+
<li> SANS - <a href="https://www.sans.org/top25-software-errors/#cat3">TOP 25 Most Dangerous Software Errors</a> </li>
2967
</ul>
3068

‎sonar-text-plugin/src/main/resources/org/sonar/l10n/secrets/rules/secrets/S6292.html

Lines changed: 61 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,68 @@
1+
<p>Secret leaks often occur when a sensitive piece of authentication data is stored with the source code of an application. Considering the source
2+
code is intended to be deployed across multiple assets, including source code repositories or application hosting servers, the secrets might get
3+
exposed to an unintended audience.</p>
14
<h2>Why is this an issue?</h2>
2-
<p>Amazon Marketplace Web Service credentials are designed to authenticate and authorize Amazon sellers.</p>
3-
<p>If your application interacts with Amazon MWS then it requires credentials to access all the resources it needs to function properly. The
5+
<p>In most cases, trust boundaries are violated when a secret is exposed in a source code repository or an uncontrolled deployment environment.
6+
Unintended people who don’t need to know the secret might get access to it. They might then be able to use it to gain unwanted access to associated
7+
services or resources.</p>
8+
<p>The trust issue can be more or less severe depending on the people’s role and entitlement.</p>
9+
<h3>What is the potential impact?</h3>
10+
<p>If your application interacts with Amazon MWS then it requires credentials to access all the resources it needs to function properly.<br> The
411
credentials authenticate to a seller account which can have access to resources like products, orders, price or shipment information.</p>
5-
<h2>Recommended Secure Coding Practices</h2>
12+
<p>Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the secret.</p>
13+
<h4>Financial loss</h4>
14+
<p>Since this secret is used to process transaction-related operations, financial loss may also occur if transaction-related objects are corrupted or
15+
the account is tampered with.<br> This can range from indirect losses to direct unauthorized transfers of funds that can lead to bankruptcy or
16+
impoverishment of individuals.</p>
17+
<h4>Phishing and spam</h4>
18+
<p>An attacker can use this secret to spam users or lure them into links to a malicious domain controlled by the attacker.</p>
19+
<p>Spam can cause users to be exposed to the following:</p>
20+
<ul>
21+
<li> Unsolicited, inappropriate content, such as pornographic material </li>
22+
<li> Fraudulent attempts to trick users into sending information or money </li>
23+
<li> Abusive or hateful statements </li>
24+
<li> False advertising or fraudulent claims </li>
25+
</ul>
26+
<p>Once a user has been phished on a legitimate-seeming third-party website, an attacker can collect the user’s credentials, bypass multi-factor
27+
authentication (MFA), and take over the user’s account on the trusted website.</p>
28+
<h4>Malware distribution</h4>
29+
<p>Due to this vulnerability, malware can be stored and spread, both to users of the service and to other potential targets.<br> A malware depends on
30+
the attacker’s intentions, as the following examples show:</p>
31+
<ul>
32+
<li> Cryptojacking malware, whose goal is to "mine" cryptocurrencies on the affected computers or servers. </li>
33+
<li> Spyware that spies out sensitive information from victims. </li>
34+
</ul>
35+
<p>In the worst case, malware can cause the target systems to be completely compromised and allow attackers to infiltrate the systems.</p>
36+
<h4>Account termination</h4>
37+
<p>Unauthorized access to mailing service API keys can also result in resource abuse. Attackers can exploit the API keys to send a large volume of
38+
spam emails or perform other resource-intensive operations, causing a significant strain on the mailing service provider’s infrastructure.</p>
39+
<p>The service provider, being vigilant about such activities, may flag your account and take action against it. This could lead to the suspension or
40+
termination of the compromised account, thus causing significant inconvenience and potential loss of communication with your customers or
41+
partners.</p>
42+
<h2>How to fix it</h2>
643
<p>Only administrators should have access to the MWS credentials used by your application.</p>
7-
<p>As a consequence, MWS credentials should not be stored along with the application code as they would grant special privilege to anyone who has
8-
access to the application source code.</p>
9-
<p>Credentials should be stored outside of the code in a file that is never committed to your application code repository.</p>
10-
<p>If possible, a better alternative is to use your cloud provider’s service for managing secrets. On AWS this service is called <a
11-
href="https://aws.amazon.com/fr/secrets-manager/">Secrets Manager</a>.</p>
12-
<p>When credentials are disclosed in the application code, consider them as compromised and revoke them immediately.</p>
44+
<p><strong>Revoke the secret</strong></p>
45+
<p>Revoke any leaked secrets and remove them from the application source code.</p>
46+
<p>Before revoking the secret, ensure that no other applications or processes are using it. Other usages of the secret will also be impacted when the
47+
secret is revoked.</p>
48+
<p><strong>Use a secret vault</strong></p>
49+
<p>A secret vault should be used to generate and store the new secret. This will ensure the secret’s security and prevent any further unexpected
50+
disclosure.</p>
51+
<p>Depending on the development platform and the leaked secret type, multiple solutions are currently available.</p>
52+
<h3>Code examples</h3>
53+
<h4>Noncompliant code example</h4>
54+
<pre data-diff-id="1" data-diff-type="noncompliant">
55+
props.set("mws-key", "amzn.mws.3b8be74a-5f63-5770-5bad-19bd40c0ac65")
56+
</pre>
57+
<h4>Compliant solution</h4>
58+
<pre data-diff-id="1" data-diff-type="compliant">
59+
props.set("mws-key", System.getenv("MWS_KEY"))
60+
</pre>
1361
<h2>Resources</h2>
62+
<h3>Standards</h3>
1463
<ul>
15-
<li> <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/">OWASP Top 10 2021 Category A7</a> - Identification and
16-
Authentication Failures </li>
17-
<li> <a href="https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">OWASP Top 10 2017 Category A3</a> - Sensitive Data
18-
Exposure </li>
19-
<li> <a href="https://cwe.mitre.org/data/definitions/798">MITRE, CWE-798</a> - Use of Hard-coded Credentials </li>
20-
<li> <a href="https://cwe.mitre.org/data/definitions/259">MITRE, CWE-259</a> - Use of Hard-coded Password </li>
21-
<li> <a href="https://www.sans.org/top25-software-errors/#cat3">SANS Top 25</a> - Porous Defenses </li>
64+
<li> MITRE - <a href="https://cwe.mitre.org/data/definitions/798">CWE-798 - Use of Hard-coded Credentials</a> </li>
65+
<li> MITRE - <a href="https://cwe.mitre.org/data/definitions/259">CWE-259 - Use of Hard-coded Password</a> </li>
66+
<li> SANS - <a href="https://www.sans.org/top25-software-errors/#cat3">TOP 25 Most Dangerous Software Errors</a> </li>
2267
</ul>
2368

‎sonar-text-plugin/src/main/resources/org/sonar/l10n/secrets/rules/secrets/S6334.html

Lines changed: 45 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,50 @@
1+
<p>Secret leaks often occur when a sensitive piece of authentication data is stored with the source code of an application. Considering the source
2+
code is intended to be deployed across multiple assets, including source code repositories or application hosting servers, the secrets might get
3+
exposed to an unintended audience.</p>
14
<h2>Why is this an issue?</h2>
2-
<p>Google API keys are used to authenticate applications that consume Google Cloud APIs. They are especially useful for accessing public data
3-
anonymously (like Google Maps), and are used to associate API requests with your project for quota and billing.</p>
4-
<p>API keys are not strictly secret as they are often embedded into client side code or mobile applications that consume Google Cloud APIs. Still,
5-
they should be secured and should never be treated as public information.</p>
6-
<p>An unrestricted Google API key being disclosed in a public source code would be used by malicious actors to consume Google APIs on the behalf of
7-
your application. This will have a financial impact as your organisation will be billed for the data consumed by the malicious actor. If your account
8-
has enabled quota to cap the API consumption of your application, this quota can be exceeded, leaving your application unable to request the Google
9-
APIs it requires to function properly.</p>
10-
<h2>Recommended Secure Coding Practices</h2>
11-
<p>Only administrators should have access to the Google API keys used by your application.</p>
12-
<p>As a consequence, Google API keys should not be stored along with the application code as they could be disclosed to a large audience or could be
13-
made public.</p>
14-
<p>Google API keys should be stored outside of the code in a file that is never committed to your application code repository.</p>
15-
<p>If possible, a better alternative is to use your cloud provider’s service for managing secrets. On Google Cloud this service is called <a
16-
href="https://cloud.google.com/secret-manager">Secret Manager</a>.</p>
17-
<p>When credentials are disclosed in the application code, consider them as compromised and revoke them immediately.</p>
18-
<p>In addition to secure storage, it’s important to apply <a
19-
href="https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions">restrictions</a> to API keys in order to mitigate the impacts when
20-
they are discovered by malicious actors.</p>
5+
<p>In most cases, trust boundaries are violated when a secret is exposed in a source code repository or an uncontrolled deployment environment.
6+
Unintended people who don’t need to know the secret might get access to it. They might then be able to use it to gain unwanted access to associated
7+
services or resources.</p>
8+
<p>The trust issue can be more or less severe depending on the people’s role and entitlement.</p>
9+
<h3>What is the potential impact?</h3>
10+
<p>Google API keys are used to authenticate applications that consume Google Cloud APIs.</p>
11+
<p>API keys are not strictly secret as they are often embedded into client-side code or mobile applications that consume Google Cloud APIs. Still,
12+
they should be secured.</p>
13+
<h4>Financial loss</h4>
14+
<p>An unrestricted Google API key being disclosed in a public source code could be used by malicious actors to consume Google APIs on behalf of your
15+
application.<br> This will have a financial impact as your organization will be billed for the data consumed by the malicious actor.</p>
16+
<h4>Denial of service</h4>
17+
<p>If your account has enabled quota to cap the API consumption of your application, this quota can be exceeded, leaving your application unable to
18+
request the Google APIs it requires to function properly.</p>
19+
<h2>How to fix it</h2>
20+
<p>Depending on the sensitivity of the key use, only administrators should have access to the Google API keys used by your application.</p>
21+
<p><strong>For client-facing keys</strong></p>
22+
<p>If the key must be sent to clients for the service to run properly, then it does not need to be revoked or added to a Vault, ignore the following
23+
sections.<br> However, it is important to apply <a href="https://cloud.google.com/docs/authentication/api-keys#securing">Google’s guidelines to secure
24+
the API keys</a>.</p>
25+
<p>These best practices will help mitigate abuse of this key.</p>
26+
<p><strong>Revoke the secret</strong></p>
27+
<p>Revoke any leaked secrets and remove them from the application source code.</p>
28+
<p>Before revoking the secret, ensure that no other applications or processes are using it. Other usages of the secret will also be impacted when the
29+
secret is revoked.</p>
30+
<p><strong>Use a secret vault</strong></p>
31+
<p>A secret vault should be used to generate and store the new secret. This will ensure the secret’s security and prevent any further unexpected
32+
disclosure.</p>
33+
<p>Depending on the development platform and the leaked secret type, multiple solutions are currently available.</p>
34+
<h3>Code examples</h3>
35+
<h4>Noncompliant code example</h4>
36+
<pre data-diff-id="1" data-diff-type="noncompliant">
37+
props.set("google-api-key", "zAIJf4Six4MjGwxvkarrf1LPUaCdyNSjzsyIoRI")
38+
</pre>
39+
<h4>Compliant solution</h4>
40+
<pre data-diff-id="1" data-diff-type="compliant">
41+
props.set("google-api-key", System.getenv("GOOGLE_API_KEY"))
42+
</pre>
2143
<h2>Resources</h2>
44+
<h3>Standards</h3>
2245
<ul>
23-
<li> <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/">OWASP Top 10 2021 Category A7</a> - Identification and
24-
Authentication Failures </li>
25-
<li> <a href="https://cloud.google.com/docs/authentication/api-keys">Google Cloud</a> - Using API keys </li>
26-
<li> <a href="https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">OWASP Top 10 2017 Category A3</a> - Sensitive Data
27-
Exposure </li>
28-
<li> <a href="https://cwe.mitre.org/data/definitions/798">MITRE, CWE-798</a> - Use of Hard-coded Credentials </li>
29-
<li> <a href="https://cwe.mitre.org/data/definitions/259">MITRE, CWE-259</a> - Use of Hard-coded Password </li>
30-
<li> <a href="https://www.sans.org/top25-software-errors/#cat3">SANS Top 25</a> - Porous Defenses </li>
46+
<li> MITRE - <a href="https://cwe.mitre.org/data/definitions/798">CWE-798 - Use of Hard-coded Credentials</a> </li>
47+
<li> MITRE - <a href="https://cwe.mitre.org/data/definitions/259">CWE-259 - Use of Hard-coded Password</a> </li>
48+
<li> SANS - <a href="https://www.sans.org/top25-software-errors/#cat3">TOP 25 Most Dangerous Software Errors</a> </li>
3149
</ul>
3250

0 commit comments

Comments
 (0)