-
Notifications
You must be signed in to change notification settings - Fork 83
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
New rules: - `Credentials in PostgreSQL Connection URI` - `Django Secret Key` - `PHPMailer Credentials` Improved rules: - `Credentials in ODBC Connection String` Other: - Fixed a currently-benign bug in regex scanning that would result in matches being lost when patterns were compiled with the `SOM_LEFTMOST` option - Adjusted logging span levels in scanning
- Loading branch information
1 parent
30369fa
commit 2598385
Showing
14 changed files
with
312 additions
and
78 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -689,6 +689,29 @@ expression: stdout | |
| ] | ||
| } | ||
| }, | ||
| { | ||
| "id": "np.django.1", | ||
| "structural_id": "da64b83c14b6ed50fb3f644c8f4243e1c2e5d9f6", | ||
| "name": "Django Secret Key", | ||
| "syntax": { | ||
| "name": "Django Secret Key", | ||
| "id": "np.django.1", | ||
| "pattern": "(?x)\n\\#\\ SECURITY\\ WARNING:\\ keep\\ the\\ secret\\ key\\ used\\ in\\ production\\ secret! \\s*\n.{0,5} SECRET_KEY \\s* = \\s* r?[\"'] ([^\"'\\n]{5,100}) [\"']\n", | ||
| "examples": [ | ||
| "# Quick-start development settings - unsuitable for production\n# See https://docs.djangoproject.com/en/5.1/howto/deployment/checklist/\n\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = 'django-insecure-_du9e^cmago!%(^+=gr@cu@v9-v7ulhbk2s3!w&39w4+n3*k*$'\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = True\n", | ||
| "# Quick-start development settings - unsuitable for production\n# See https://docs.djangoproject.com/en/5.1/howto/deployment/checklist/\n\n# SECURITY WARNING: keep the secret key used in production secret!\n# SECRET_KEY = 'django-insecure-_du9e^cmago!%(^+=gr@cu@v9-v7ulhbk2s3!w&39w4+n3*k*$'\nSECRET_KEY = 'hmm'\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = True\n" | ||
| ], | ||
| "negative_examples": [], | ||
| "references": [ | ||
| "https://docs.djangoproject.com/en/5.1/ref/settings/#std-setting-SECRET_KEY", | ||
| "https://docs.djangoproject.com/en/5.1/topics/signing/" | ||
| ], | ||
| "categories": [ | ||
| "fuzzy", | ||
| "secret" | ||
| ] | ||
| } | ||
| }, | ||
| { | ||
| "id": "np.dockerhub.1", | ||
| "structural_id": "ee5a64a1fc638eb07dcae2cfd5a32bb3f583395b", | ||
|
|
@@ -1695,6 +1718,7 @@ expression: stdout | |
| ], | ||
| "categories": [ | ||
| "secret", | ||
| "fuzzy", | ||
| "generic" | ||
| ] | ||
| } | ||
|
|
@@ -1717,6 +1741,7 @@ expression: stdout | |
| ], | ||
| "categories": [ | ||
| "secret", | ||
| "fuzzy", | ||
| "generic" | ||
| ] | ||
| } | ||
|
|
@@ -2292,12 +2317,12 @@ expression: stdout | |
| }, | ||
| { | ||
| "id": "np.odbc.1", | ||
| "structural_id": "630c1001441e63d74fea2a730a5196ee38ac818b", | ||
| "structural_id": "6acf132b0cc66853bd5da65ce86f680e7147c003", | ||
| "name": "Credentials in ODBC Connection String", | ||
| "syntax": { | ||
| "name": "Credentials in ODBC Connection String", | ||
| "id": "np.odbc.1", | ||
| "pattern": "(?x)(?i)\n(?: User | User\\ Id | UserId | Uid) \\s*=\\s* ([^\\s;]{3,100}) \\s* ;\n[\\ \\t]* .{0,10} [\\ \\t]* (?# possible extra stuff, e.g., string concatenation)\n(?: Password | Pwd) \\s*=\\s* ([^\\t\\ ;]{3,100}) \\s* (?: [;] | $)\n", | ||
| "pattern": "(?x)(?i)\n(?: User | User\\ Id | UserId | Uid) \\s*=\\s* ([^\\s;]{3,100}) \\s* ;\n[\\ \\t]* .{0,10} [\\ \\t]* (?# possible extra stuff, e.g., string concatenation)\n(?: Password | Pwd) \\s*=\\s* ([^\\t\\ ;]{3,100})\n\\s* (?: [;\"'] | $)\n", | ||
| "examples": [ | ||
| "//Database Info\\r\\n\\t\\t\\t\\t\\t$host = \\\"localhost\\\";\\r\\n\\t\\t\\t\\t\\t$database = \\\"NHOHVA\\\";\\r\\n\\t\\t\\t\\t\\t$user = \\\"mg1021\\\"; $password = \\\"goodspec\\\";", | ||
| "//Database Info\\r\\n\\t\\t\\t\\t\\t$host = \\\"localhost\\\";\\r\\n\\t\\t\\t\\t\\t$database = \\\"NHOHVA\\\";\\r\\n\\t\\t\\t\\t\\t$user = \\\"mg1021\\\"; $password = goodspec;", | ||
|
|
@@ -2307,7 +2332,8 @@ expression: stdout | |
| "Data Source=190.190.200.100,1433;Network_library=DBMSSOCN;Initial Catalog=myDataBase;User ID=myUsername;Password=myPassword;", | ||
| "Provider=SQLNCLI;Server=myServerName,myPortNumber;Database=myDataBase;Uid=myUsername;Pwd=myPassword;", | ||
| " adoConn.Open(\"Provider=SQLOLEDB.1;User ID=specialbill_user; \" & \"Password =specialbill_user;Initial Catalog=SpecialBill_PROD;Data Source=uszdba01;\")", | ||
| "\"driver={SQL Server};server=(#{datastore['DBHOST']});database=#{datastore['DBNAME']};uid=#{datastore['DBUID']};pwd=#{datastore['DBPASSWORD']}\"\n" | ||
| "\"driver={SQL Server};server=(#{datastore['DBHOST']});database=#{datastore['DBNAME']};uid=#{datastore['DBUID']};pwd=#{datastore['DBPASSWORD']}\"\n", | ||
| "<add name=\"DevQATrucks\" connectionString=\"Server=hookupsqlqa1\\gpkqa; Database=YogurtDelay: User Id=kmwulfliq; password= sK!g2Ex_=jJ6Gx5v\" providerName=\"System.Data.SqlClient\" />" | ||
| ], | ||
| "negative_examples": [ | ||
| "def login(self, user = '', password = '', domain = ''):", | ||
|
|
@@ -2479,6 +2505,54 @@ expression: stdout | |
| ] | ||
| } | ||
| }, | ||
| { | ||
| "id": "np.phpmailer.1", | ||
| "structural_id": "d6cefbc0eb75afeabb5915dd45dcbf8697380120", | ||
| "name": "PHPMailer Credentials", | ||
| "syntax": { | ||
| "name": "PHPMailer Credentials", | ||
| "id": "np.phpmailer.1", | ||
| "pattern": "(?x)\n\\$mail->Host \\s* = \\s* '([^'\\n]{5,})'; \\s* (?: //.* )?\n(?: \\s* .* \\s* ){0,3}\n\\$mail->Username \\s* = \\s* '([^'\\n]{5,})'; \\s* (?: //.* )?\n(?: \\s* .* \\s* ){0,3}\n\\$mail->Password \\s* = \\s* '([^'\\n]{5,})';\n", | ||
| "examples": [ | ||
| "//Server settings\n$mail->SMTPDebug = SMTP::DEBUG_SERVER; //Enable verbose debug output\n$mail->isSMTP(); //Send using SMTP\n$mail->Host = 'smtp.example.com'; //Set the SMTP server to send through\n$mail->SMTPAuth = true; //Enable SMTP authentication\n$mail->Username = '[email protected]'; //SMTP username\n$mail->Password = 'secret'; //SMTP password\n$mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS; //Enable implicit TLS encryption\n$mail->Port = 465; //TCP port to connect to; use 587 if you have set `SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS`\n", | ||
| "require 'PHPMailerAutoload.php';\n\nfunction SendMail($sub,$to,$msg)\n{\n $mail = new PHPMailer;\n $mail->isSMTP(); // Set mailer to use SMTP\n $mail->Host = 'smtp.gmail.com'; // Specify main and backup SMTP servers\n $mail->SMTPAuth = true; // Enable SMTP authentication\n $mail->SMTPSecure = 'tls'; // Enable encryption, 'ssl' also accepted\n $mail->Username = '[email protected]'; // SMTP username\n\n\n\n $mail->Password = 'un!techwhooah'; // SMTP password\n $mail->From = '[email protected]';\n $mail->FromName = 'Admin';\n" | ||
| ], | ||
| "negative_examples": [], | ||
| "references": [ | ||
| "https://github.com/PHPMailer/PHPMailer" | ||
| ], | ||
| "categories": [ | ||
| "fuzzy", | ||
| "secret" | ||
| ] | ||
| } | ||
| }, | ||
| { | ||
| "id": "np.postgres.1", | ||
| "structural_id": "d1b558227cf1fa521f2db96bac75c1914554d667", | ||
| "name": "Credentials in PostgreSQL Connection URI", | ||
| "syntax": { | ||
| "name": "Credentials in PostgreSQL Connection URI", | ||
| "id": "np.postgres.1", | ||
| "pattern": "(?x)\n(?: postgres | postgresql ) :// (?# URI scheme )\n ([a-zA-Z0-9.-~]{3,}) (?# username)\n: ([a-zA-Z0-9.-~]{3,}) (?# password)\n@ ([a-zA-Z0-9_.-]{3,} (?: :\\d{1,5})?) (?# hostname and port)\n(/[a-zA-Z0-9_.-]{2,}) (?# database)\n(?: \\? [a-zA-Z0-9.-~]+ = [a-zA-Z0-9.-~]+\n (?: & [a-zA-Z0-9.-~]+ = [a-zA-Z0-9.-~]+ )* )? (?# query params )\n(?: [^a-zA-Z0-9.-~] | $ )\n", | ||
| "examples": [ | ||
| "\"REDSHIFT\": \"postgres://spot_app:Pseg2020@calling-mr-bones.c0qsadyxbf4k.us-east-1.redshift.amazonaws.com:5439/datalakespotprod\",", | ||
| "postgresql://user:secret@localhost/database", | ||
| "postgresql://user:secret@localhost/otherdb?connect_timeout=10&application_name=myapp" | ||
| ], | ||
| "negative_examples": [ | ||
| "postgresql://user:secret@[2001:db8::1234]/database", | ||
| "postgresql://user:secret@host1:123,user:secret@host2:456/somedb?target_session_attrs=any&application_name=myapp", | ||
| "postgresql:///mydb?host=localhost&port=5433&user=user&password=secret" | ||
| ], | ||
| "references": [ | ||
| "https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING" | ||
| ], | ||
| "categories": [ | ||
| "secret" | ||
| ] | ||
| } | ||
| }, | ||
| { | ||
| "id": "np.postman.1", | ||
| "structural_id": "92b0a519b4ad321547051c203e58ed828d2480e1", | ||
|
|
@@ -3552,7 +3626,7 @@ expression: stdout | |
| { | ||
| "id": "default", | ||
| "name": "Nosey Parker default rules", | ||
| "num_rules": 126 | ||
| "num_rules": 129 | ||
| }, | ||
| { | ||
| "id": "np.assets", | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| rules: | ||
|
|
||
| - name: Django Secret Key | ||
| id: np.django.1 | ||
|
|
||
| # This identifies cryptographic signing secrets in configuration files generated by `django-admin startproject`. | ||
| pattern: | | ||
| (?x) | ||
| \#\ SECURITY\ WARNING:\ keep\ the\ secret\ key\ used\ in\ production\ secret! \s* | ||
| .{0,5} SECRET_KEY \s* = \s* r?["'] ([^"'\n]{5,100}) ["'] | ||
| categories: [fuzzy, secret] | ||
|
|
||
| examples: | ||
| - | | ||
| # Quick-start development settings - unsuitable for production | ||
| # See https://docs.djangoproject.com/en/5.1/howto/deployment/checklist/ | ||
| # SECURITY WARNING: keep the secret key used in production secret! | ||
| SECRET_KEY = 'django-insecure-_du9e^cmago!%(^+=gr@cu@v9-v7ulhbk2s3!w&39w4+n3*k*$' | ||
| # SECURITY WARNING: don't run with debug turned on in production! | ||
| DEBUG = True | ||
| - | | ||
| # Quick-start development settings - unsuitable for production | ||
| # See https://docs.djangoproject.com/en/5.1/howto/deployment/checklist/ | ||
| # SECURITY WARNING: keep the secret key used in production secret! | ||
| # SECRET_KEY = 'django-insecure-_du9e^cmago!%(^+=gr@cu@v9-v7ulhbk2s3!w&39w4+n3*k*$' | ||
| SECRET_KEY = 'hmm' | ||
| # SECURITY WARNING: don't run with debug turned on in production! | ||
| DEBUG = True | ||
| references: | ||
| - https://docs.djangoproject.com/en/5.1/ref/settings/#std-setting-SECRET_KEY | ||
| - https://docs.djangoproject.com/en/5.1/topics/signing/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.