Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 50cde34

Browse files
Max SchaeferGitHub Enterprise
Max Schaefer
authored and
GitHub Enterprise
committed
Merge pull request #181 from sauyon/hardcoded-sensitive
HardcodedCredentials: Use SensitiveActions
2 parents ed95cde + 50a0089 commit 50cde34

File tree

6 files changed

+26
-32
lines changed

6 files changed

+26
-32
lines changed

‎ql/src/Security/CWE-798/HardcodedCredentials.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import (
1111

1212
const (
1313
user = "dbuser"
14-
password = "secretpassword"
14+
password = "s3cretp4ssword"
1515
)
1616

1717
func connect() *sql.DB {

‎ql/src/Security/CWE-798/HardcodedCredentials.ql

Lines changed: 9 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -13,37 +13,31 @@
1313
*/
1414

1515
import go
16+
import semmle.go.security.SensitiveActions
1617

1718
/**
1819
* Holds if `sink` is used in a context that suggests it may hold sensitive data of
1920
* the given `type`.
2021
*/
21-
predicate isSensitive(DataFlow::Node sink, string type) {
22+
predicate isSensitive(DataFlow::Node sink, SensitiveExpr::Classification type) {
2223
exists(Write write, string name |
2324
write.getRhs() = sink and
2425
name = write.getLhs().getName() and
2526
// whitelist obvious test password variables
26-
not name.regexpMatch("(?i)test.*")
27+
not name.regexpMatch(HeuristicNames::notSensitive())
2728
|
28-
name.regexpMatch("(?i)_*secret") and
29-
type = "secret"
30-
or
31-
name.regexpMatch("(?i)_*(secret|access|private|rsa|aes)_*key") and
32-
type = "key"
33-
or
34-
name.regexpMatch("(?i)_*(encrypted|old|new)?_*pass(wd|word|code|phrase)_*(chars|value)?") and
35-
type = "password"
29+
name.regexpMatch(HeuristicNames::maybeSensitive(type))
3630
)
3731
}
3832

39-
from DataFlow::Node source, string message, DataFlow::Node sink, string type
33+
from DataFlow::Node source, string message, DataFlow::Node sink, SensitiveExpr::Classification type
4034
where
4135
exists(string val | val = source.getStringValue() and val != "" |
4236
isSensitive(sink, type) and
4337
DataFlow::localFlow(source, sink) and
4438
// whitelist obvious dummy/test values
45-
not val.regexpMatch("(?i)test|password|secret|--- redacted ---") and
46-
not sink.asExpr().(Ident).getName().regexpMatch("(?i)test.*")
39+
not PasswordHeuristics::isDummyPassword(val) and
40+
not sink.asExpr().(Ident).getName().regexpMatch(HeuristicNames::notSensitive())
4741
) and
4842
message = "Hard-coded $@."
4943
or
@@ -52,6 +46,6 @@ where
5246
.regexpMatch("(?s)-+BEGIN\\b.*\\bPRIVATE KEY-+.+-+END\\b.*\\bPRIVATE KEY-+\n?") and
5347
(source.asExpr() instanceof StringLit or source.asExpr() instanceof AddExpr) and
5448
sink = source and
55-
type = "" and
49+
type = SensitiveExpr::certificate() and
5650
message = "Hard-coded private key."
57-
select sink, message, source, type
51+
select sink, message, source, type.toString()

‎ql/src/semmle/go/security/SensitiveActions.qll

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,10 +63,10 @@ module HeuristicNames {
6363

6464
/**
6565
* Gets a regular expression that identifies strings that may indicate the presence of data
66-
* that is hashed or encrypted, and hence rendered non-sensitive.
66+
* that is hashed, encrypted, or a test value, and hence non-sensitive.
6767
*/
6868
string notSensitive() {
69-
result = "(?is).*(redact|censor|obfuscate|hash|md5|sha|((?<!un)(en))?(crypt|code)).*"
69+
result = "(?is).*(test|redact|censor|obfuscate|hash|md5|sha|((?<!un)(en))?(crypt|code)).*"
7070
}
7171
}
7272

@@ -244,7 +244,8 @@ module PasswordHeuristics {
244244
or
245245
exists(string normalized | normalized = password.toLowerCase() |
246246
count(normalized.charAt(_)) = 1 or
247-
normalized.regexpMatch(".*(pass|test|sample|example|secret|root|admin|user|change|auth).*")
247+
normalized
248+
.regexpMatch(".*(pass|test|sample|example|secret|root|admin|user|change|auth|redacted).*")
248249
)
249250
}
250251
}

‎ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
| AlertSuppressionExample.go:11:14:11:40 | "horsebatterystaplecorrect" | Hard-coded $@. | AlertSuppressionExample.go:11:14:11:40 | "horsebatterystaplecorrect" | password |
2-
| HardcodedCredentials.go:10:13:10:28 | "secretpassword" | Hard-coded $@. | HardcodedCredentials.go:10:13:10:28 | "secretpassword" | password |
3-
| main.go:6:17:6:26 | "passw0rd" | Hard-coded $@. | main.go:6:17:6:26 | "passw0rd" | password |
4-
| main.go:13:1:27:30 | `-----BEGIN RSA PRIVATE KEY-----\nMIICXQIBAAKBgQC/tzdtXKXcX6F3v3hR6+uYyZpIeXhhLflJkY2eILLQfAnwKlT5\nxIHW5QZcHQV9sCyZ8qSdPGif7PwgMbButMbByiZhCSugUFb6vjVqoktmslYF4LKH\niDgvmlwuJW0TvynxBLzDCwrRP+gpRT8wuAortWAx/03POTw7Mzi2cIPNsQIDAQAB\nAoGAMHCrqY9CPTdQhgAz94cDpTwzJmLCvtMt7J/BR5X9eF4O6MbZZ652HAUMIVQX\n4hUUf+VmIHB2AwqO/ddwO9ijaz04BslOSy/iYevHGlH65q4587NSlFWjvILMIQCM\nGBjfzJIxlLHVhjc2cFnyAE5YWjF/OMnJN0OhP9pxmCP/iM0CQQDxmQndQLdnV7+6\n8SvBHE8bg1LE8/BzTt68U3aWwiBjrHMFgzr//7Za4VF7h4ilFgmbh0F3sYz+C8iO\n0JrBRPeLAkEAyyTwnv/pgqTS/wuxIHUxRBpbdk3YvILAthNrGQg5uzA7eSeFu7Mv\nGtEkXsaqCDbdehgarFfNN8PB6OMRIbsXMwJBAOjhH8UJ0L/osYO9XPO0GfznRS1c\nBnbfm4vk1/bSAO6TF/xEVubU0i4f6q8sIecfqvskEVMS7lkjeptPMR0DIakCQE+7\nuQH/Wizf+r0GXshplyOu4LVHisk63N7aMlAJ7XbuUHmWLKRmiReSfR8CBNzig/2X\nFmkMsUyw9hwte5zsrQcCQQCrOkZvzUj9j1HKG+32EJ2E4kisJZmAgF9GI+z6oxpi\nExped5tp8EWytCjRwKhOcc0068SgaqhKvyyUWpbx32VQ\n-----END RSA PRIVATE KEY-----` | Hard-coded private key. | main.go:13:1:27:30 | `-----BEGIN RSA PRIVATE KEY-----\nMIICXQIBAAKBgQC/tzdtXKXcX6F3v3hR6+uYyZpIeXhhLflJkY2eILLQfAnwKlT5\nxIHW5QZcHQV9sCyZ8qSdPGif7PwgMbButMbByiZhCSugUFb6vjVqoktmslYF4LKH\niDgvmlwuJW0TvynxBLzDCwrRP+gpRT8wuAortWAx/03POTw7Mzi2cIPNsQIDAQAB\nAoGAMHCrqY9CPTdQhgAz94cDpTwzJmLCvtMt7J/BR5X9eF4O6MbZZ652HAUMIVQX\n4hUUf+VmIHB2AwqO/ddwO9ijaz04BslOSy/iYevHGlH65q4587NSlFWjvILMIQCM\nGBjfzJIxlLHVhjc2cFnyAE5YWjF/OMnJN0OhP9pxmCP/iM0CQQDxmQndQLdnV7+6\n8SvBHE8bg1LE8/BzTt68U3aWwiBjrHMFgzr//7Za4VF7h4ilFgmbh0F3sYz+C8iO\n0JrBRPeLAkEAyyTwnv/pgqTS/wuxIHUxRBpbdk3YvILAthNrGQg5uzA7eSeFu7Mv\nGtEkXsaqCDbdehgarFfNN8PB6OMRIbsXMwJBAOjhH8UJ0L/osYO9XPO0GfznRS1c\nBnbfm4vk1/bSAO6TF/xEVubU0i4f6q8sIecfqvskEVMS7lkjeptPMR0DIakCQE+7\nuQH/Wizf+r0GXshplyOu4LVHisk63N7aMlAJ7XbuUHmWLKRmiReSfR8CBNzig/2X\nFmkMsUyw9hwte5zsrQcCQQCrOkZvzUj9j1HKG+32EJ2E4kisJZmAgF9GI+z6oxpi\nExped5tp8EWytCjRwKhOcc0068SgaqhKvyyUWpbx32VQ\n-----END RSA PRIVATE KEY-----` | |
5-
| main.go:45:14:45:19 | "pass" | Hard-coded $@. | main.go:45:14:45:19 | "pass" | password |
6-
| main.go:49:13:49:15 | tmp | Hard-coded $@. | main.go:45:14:45:19 | "pass" | password |
7-
| main.go:51:15:51:21 | "pass2" | Hard-coded $@. | main.go:51:15:51:21 | "pass2" | password |
2+
| HardcodedCredentials.go:10:13:10:28 | "s3cretp4ssword" | Hard-coded $@. | HardcodedCredentials.go:10:13:10:28 | "s3cretp4ssword" | password |
3+
| main.go:6:14:6:23 | "p4ssw0rd" | Hard-coded $@. | main.go:6:14:6:23 | "p4ssw0rd" | password |
4+
| main.go:12:1:26:30 | `-----BEGIN RSA PRIVATE KEY-----\nMIICXQIBAAKBgQC/tzdtXKXcX6F3v3hR6+uYyZpIeXhhLflJkY2eILLQfAnwKlT5\nxIHW5QZcHQV9sCyZ8qSdPGif7PwgMbButMbByiZhCSugUFb6vjVqoktmslYF4LKH\niDgvmlwuJW0TvynxBLzDCwrRP+gpRT8wuAortWAx/03POTw7Mzi2cIPNsQIDAQAB\nAoGAMHCrqY9CPTdQhgAz94cDpTwzJmLCvtMt7J/BR5X9eF4O6MbZZ652HAUMIVQX\n4hUUf+VmIHB2AwqO/ddwO9ijaz04BslOSy/iYevHGlH65q4587NSlFWjvILMIQCM\nGBjfzJIxlLHVhjc2cFnyAE5YWjF/OMnJN0OhP9pxmCP/iM0CQQDxmQndQLdnV7+6\n8SvBHE8bg1LE8/BzTt68U3aWwiBjrHMFgzr//7Za4VF7h4ilFgmbh0F3sYz+C8iO\n0JrBRPeLAkEAyyTwnv/pgqTS/wuxIHUxRBpbdk3YvILAthNrGQg5uzA7eSeFu7Mv\nGtEkXsaqCDbdehgarFfNN8PB6OMRIbsXMwJBAOjhH8UJ0L/osYO9XPO0GfznRS1c\nBnbfm4vk1/bSAO6TF/xEVubU0i4f6q8sIecfqvskEVMS7lkjeptPMR0DIakCQE+7\nuQH/Wizf+r0GXshplyOu4LVHisk63N7aMlAJ7XbuUHmWLKRmiReSfR8CBNzig/2X\nFmkMsUyw9hwte5zsrQcCQQCrOkZvzUj9j1HKG+32EJ2E4kisJZmAgF9GI+z6oxpi\nExped5tp8EWytCjRwKhOcc0068SgaqhKvyyUWpbx32VQ\n-----END RSA PRIVATE KEY-----` | Hard-coded private key. | main.go:12:1:26:30 | `-----BEGIN RSA PRIVATE KEY-----\nMIICXQIBAAKBgQC/tzdtXKXcX6F3v3hR6+uYyZpIeXhhLflJkY2eILLQfAnwKlT5\nxIHW5QZcHQV9sCyZ8qSdPGif7PwgMbButMbByiZhCSugUFb6vjVqoktmslYF4LKH\niDgvmlwuJW0TvynxBLzDCwrRP+gpRT8wuAortWAx/03POTw7Mzi2cIPNsQIDAQAB\nAoGAMHCrqY9CPTdQhgAz94cDpTwzJmLCvtMt7J/BR5X9eF4O6MbZZ652HAUMIVQX\n4hUUf+VmIHB2AwqO/ddwO9ijaz04BslOSy/iYevHGlH65q4587NSlFWjvILMIQCM\nGBjfzJIxlLHVhjc2cFnyAE5YWjF/OMnJN0OhP9pxmCP/iM0CQQDxmQndQLdnV7+6\n8SvBHE8bg1LE8/BzTt68U3aWwiBjrHMFgzr//7Za4VF7h4ilFgmbh0F3sYz+C8iO\n0JrBRPeLAkEAyyTwnv/pgqTS/wuxIHUxRBpbdk3YvILAthNrGQg5uzA7eSeFu7Mv\nGtEkXsaqCDbdehgarFfNN8PB6OMRIbsXMwJBAOjhH8UJ0L/osYO9XPO0GfznRS1c\nBnbfm4vk1/bSAO6TF/xEVubU0i4f6q8sIecfqvskEVMS7lkjeptPMR0DIakCQE+7\nuQH/Wizf+r0GXshplyOu4LVHisk63N7aMlAJ7XbuUHmWLKRmiReSfR8CBNzig/2X\nFmkMsUyw9hwte5zsrQcCQQCrOkZvzUj9j1HKG+32EJ2E4kisJZmAgF9GI+z6oxpi\nExped5tp8EWytCjRwKhOcc0068SgaqhKvyyUWpbx32VQ\n-----END RSA PRIVATE KEY-----` | certificate |
5+
| main.go:44:14:44:19 | "p4ss" | Hard-coded $@. | main.go:44:14:44:19 | "p4ss" | password |
6+
| main.go:48:13:48:15 | tmp | Hard-coded $@. | main.go:44:14:44:19 | "p4ss" | password |
7+
| main.go:50:15:50:21 | "p4ss2" | Hard-coded $@. | main.go:50:15:50:21 | "p4ss2" | password |

‎ql/test/query-tests/Security/CWE-798/HardcodedCredentials.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import (
77

88
const (
99
user = "dbuser"
10-
password = "secretpassword"
10+
password = "s3cretp4ssword"
1111
)
1212

1313
func connect() *sql.DB {

‎ql/test/query-tests/Security/CWE-798/main.go

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,8 @@ package main
33
import "fmt"
44

55
const (
6-
passwd = "passw0rd" // NOT OK
7-
notAPassword = "hello" // OK
8-
_password = "" // OK
6+
passwd = "p4ssw0rd" // NOT OK
7+
_password = "" // OK
98
)
109

1110
// generated using http://travistidwell.com/jsencrypt/demo
@@ -42,15 +41,15 @@ type info struct {
4241
}
4342

4443
func main() {
45-
password := "pass" // NOT OK
44+
password := "p4ss" // NOT OK
4645
tmp := password
4746
i := info{
4847
username: "me",
4948
password: tmp, // NOT OK
5049
}
51-
i.password = "pass2" // NOT OK
50+
i.password = "p4ss2" // NOT OK
5251
fmt.Println(password, i)
53-
testPassword := "pass" // OK
52+
testPassword := "p4ss" // OK
5453
i.password = "test" // OK
5554
i.password = testPassword // OK
5655
secretKey = "secret" // OK

0 commit comments

Comments
 (0)