puppet-lint-infrasecure 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af41dd57d2277014626a4346718c4fecc7ac7f1bb62a544d69853058837092bc
-  data.tar.gz: 0f174a79194cdfaae29db7de3d720e5194a06ee91d9808b4db3c910c408565ed
+  metadata.gz: 1ccfc1a16704f252eb18653d27c22f1bb519afaf09c2527db4b776d0884e6846
+  data.tar.gz: bf3a2457fcb232299b77bee3ebfb379b76e1baa3b3ea52d21c8f7e39399b2bdd
 SHA512:
-  metadata.gz: a94c3cf0b774ec50dcc4610b7cf281768af290a025f7a282c5d7a1281e3152c9607e5cba886007a56465f416bd5458c6eaefe66545c50526a27d266a796121fd
-  data.tar.gz: 9eff8346d97c2c31b9716b276c9905e29a7e9d2cfb0e6c0e0dd7b7a40404bfb2fa1d05edb0e5d4ec2fe8ac2f9cb351a32f538fc963b623a02bccd25c342ac790
+  metadata.gz: 923cb4e0e996e1e1886836447dde93f5989e691142396a98c3e435f4f04214b7fe09083bbc09f66c791e98f75d030c916a633ef5215df35beb876c98612f821b
+  data.tar.gz: f62d22690a41560085df4744427362b7ff984ddf26caac75ee1ee52d1476bf9c5daf802255b4cbe301b6a5be7cf9c6fc643e80320c7e455be14cbc7cb30c0b8a

data/lib/puppet-lint/linter.rb

@@ -118,6 +118,38 @@ class PuppetLint::CheckPlugin
       return ftokens
    end
 
+   def filter_credentials(tokens)
+      credentials = {}  
+      tokens.each do |token|         
+         next if token.next_code_token.nil?
+         next if token.prev_code_token.nil?
+         # accepts (<VARIABLE>|<NAME>) =~ SECRET (<EQUALS>|<FARROW>) !(<STRING>|<SSTRING>|<NAME>) =~ (NONSECRET AND PLACHOLDER)
+         if [:VARIABLE, :NAME].include? token.prev_code_token.type and [:EQUALS, :FARROW].include? token.type and token.prev_code_token.value.downcase =~ Rules.secret and !(token.next_code_token.value.downcase =~ Rules.nonsecret) and !(token.next_code_token.value.downcase =~ Rules.placeholder)
+            # check if username
+            left_side_value = token.prev_code_token.value.downcase
+            is_username = left_side_value[Rules.username]
+            is_password = left_side_value[Rules.password]
+            if !is_username.nil?
+               puts is_username
+               context = left_side_value.gsub(is_username, '')
+               if context.length > 0
+                  puts "CONTEXT", context
+               end
+               credentials.merge!(context => {:username => left_side_value }) if context.length > 0
+            end
+            if !is_password.nil?
+               puts is_password
+               context = left_side_value.gsub(is_password, '')
+               if context.length > 0
+                  puts "CONTEXT", context
+               end
+               credentials.merge!(context => {:password => left_side_value }) if context.length > 0
+            end
+         end
+      end
+      puts credentials
+   end
+
    def filter_variables(tokens, keywords)
       line = -1
       kw_regex = Regexp.new keywords.join("|")

data/lib/puppet-lint/plugins/check_admin_by_default.rb

@@ -3,21 +3,28 @@ require 'puppet-lint-infrasecure'
 PuppetLint.new_check(:admin_by_default) do
 
    def check
-        ftokens = get_tokens(tokens,'admin')
-        ftokens.each do |token|
-         token_value = token.value.downcase
-         if [:EQUALS, :FARROW].include? token.prev_code_token.type
-            prev_token = token.prev_code_token
-            left_side = prev_token.prev_code_token
-            if left_side.value.downcase =~ Rules.credentials and [:VARIABLE, :NAME].include? left_side.type
-               if token_value == 'admin'
-                  notify :warning, {
-               message: "[SECURITY] Admin by default (line=#{token.line}, col=#{token.column}) | Do not make user/password as admin as for $#{prev_token.prev_code_token.value.downcase} in line #{token.line}. This can be easily exploited.",
-               line:    token.line,
-               column:  token.column,
-               token:   token_value,
-               cwe: 'CWE-250'
-            }
+      tokens.each do |token|
+         next if token.next_code_token.nil?
+         next if token.prev_code_token.nil?
+         # accepts (<VARIABLE>|<NAME>) (<EQUALS>|<FARROW>) (<STRING>|<SSTRING>)
+         if [:VARIABLE, :NAME].include? token.prev_code_token.type and [:EQUALS, :FARROW].include? token.type and [:STRING, :SSTRING].include? token.next_code_token.type
+            left_side_value = token.prev_code_token.value.downcase
+            right_side_value = token.next_code_token.value.downcase
+            
+            # left side checkers (<VARIABLE>|<NAME>)
+            if !(left_side_value =~ Rules.nonsecret) and left_side_value =~ Rules.username and !left_side_value[/(admin|root)/]
+               # right side checkers (<STRING>|<SSTRING>)
+               if !(right_side_value =~ Rules.placeholder) and right_side_value.length > 1 and !(right_side_value =~ /\/.*./ )
+                  # final check
+                  if ['admin', 'root'].include? right_side_value
+                     notify :warning, {
+                        message: "[SECURITY][CWE-250] Admin by default (line=#{token.line}, col=#{token.column}) | Do not make user as admin as for $#{left_side_value} in line #{token.line}. This can be easily exploited.",
+                        line:    token.line,
+                        column:  token.column,
+                        token:   right_side_value,
+                        cwe: 'CWE-250'
+                     }
+                  end
                end
             end
          end

data/lib/puppet-lint/plugins/check_cyrillic_homograph_attack.rb

@@ -2,17 +2,23 @@ require 'puppet-lint-infrasecure'
 
 PuppetLint.new_check(:cyrillic_homograph_attack) do   
    def check
-      ftokens = filter_tokens(tokens)
       tokens.each do |token|
-         token_value = token.value.downcase
-         if [:STRING, :SSTRING].include? token.type and token_value =~ Rules.cyrillic 
-            notify :warning, {
-               message: "[SECURITY] Homograph Attack (line=#{token.line}, col=#{token.column}). This link (#{token_value}) has a cyrillic char. These are not rendered by browsers and are sometimes used for phishing attacks.",
-               line: token.line,
-               column: token.column,
-               token: token_value,
-               cwe: 'CWE-1007'
-            }
+         next if token.next_code_token.nil?
+         next if token.prev_code_token.nil?
+         # accepts (<VARIABLE>|<NAME>) (<EQUALS>|<FARROW>) (<STRING>|<SSTRING>)
+         if [:VARIABLE, :NAME].include? token.prev_code_token.type and [:EQUALS, :FARROW].include? token.type and [:STRING, :SSTRING].include? token.next_code_token.type
+            left_side_value = token.prev_code_token.value.downcase
+            right_side_value = token.next_code_token.value.downcase
+            # checks (<STRING>|<SSTRING>)
+            if right_side_value =~ Rules.cyrillic 
+               notify :warning, {
+                  message: "[SECURITY][CWE-1007] Homograph Attack (line=#{token.next_code_token.line}, col=#{token.next_code_token.column}). This link (#{right_side_value}) has a cyrillic char. These chars are not rendered by browsers and are sometimes used for phishing attacks. It can also result in typosquatting attacks.",
+                  line: token.next_code_token.line,
+                  column: token.next_code_token.column,
+                  token: token.next_code_token.value,
+                  cwe: 'CWE-1007'
+               }
+            end
          end
       end
    end

data/lib/puppet-lint/plugins/check_empty_password.rb

@@ -3,22 +3,21 @@ require 'puppet-lint-infrasecure'
 PuppetLint.new_check(:empty_password) do
 
    def check
-      ftokens = get_string_tokens(tokens,'')
-      ftokens.each do |token|
-         token_value = token.value.downcase
-         if [:EQUALS, :FARROW].include? token.prev_code_token.type 
-            prev_token = token.prev_code_token
-            left_side = prev_token.prev_code_token
-            if left_side.value.downcase =~ Rules.password and [:VARIABLE, :NAME].include? left_side.type
-               if token_value == ''
-                  notify :warning, {
-               message: "[SECURITY] Empty Password (line=#{token.line}, col=#{token.column}) | Do not keep the password field empty as for $#{prev_token.prev_code_token.value.downcase} in line #{token.line}. Use kms/heira/vault instead.",
-               line:    token.line,
-               column:  token.column,
-               token:   token_value,
-               cwe: 'CWE-258'
-            }
-               end
+      tokens.each do |token|
+         next if token.next_code_token.nil?
+         next if token.prev_code_token.nil?
+         # accepts (<VARIABLE>|<NAME>) (<EQUALS>|<FARROW>) (<STRING>|<SSTRING>)
+         if [:VARIABLE, :NAME].include? token.prev_code_token.type and [:EQUALS, :FARROW].include? token.type and [:STRING, :SSTRING].include? token.next_code_token.type
+            left_side_value = token.prev_code_token.value.downcase
+            right_side_value = token.next_code_token.value.downcase
+            if left_side_value =~ Rules.password and right_side_value  == ''
+               notify :warning, {
+                  message: "[SECURITY][CWE-258] Empty Password (line=#{token.next_code_token.line}, col=#{token.next_code_token.column}) | Do not keep the password field empty as for $#{token.prev_code_token.value} in line #{token.prev_code_token.line}. Use a stronger password.",
+                  line:    token.next_code_token.line,
+                  column:  token.next_code_token.column,
+                  token:   token.next_code_token.value,
+                  cwe: 'CWE-258'
+               }
             end
          end
       end

data/lib/puppet-lint/plugins/check_hard_coded_key.rb

@@ -0,0 +1,28 @@
+require 'puppet-lint-infrasecure'
+
+PuppetLint.new_check(:hardcoded_secret_key) do
+   def check
+      tokens.each do |token|
+         next if token.next_code_token.nil?
+         next if token.prev_code_token.nil?
+         # accepts (<VARIABLE>|<NAME>) (<EQUALS>|<FARROW>) (<STRING>|<SSTRING>)
+         if [:VARIABLE, :NAME].include? token.prev_code_token.type and [:EQUALS, :FARROW].include? token.type and [:STRING, :SSTRING].include? token.next_code_token.type
+            left_side_value = token.prev_code_token.value.downcase
+            right_side_value = token.next_code_token.value.downcase
+            # checks left side (<VARIABLE>|<NAME>)
+            if left_side_value =~ Rules.key and !(left_side_value =~ Rules.nonsecret)
+               # checks right side (<STRING>|<SSTRING>)
+               if !(right_side_value =~ Rules.placeholder) and right_side_value.length > 1 and !right_side_value[/\/.*(\/)+/]
+                  notify :warning, {
+                     message: "[SECURITY][CWE-321] Hard Coded Key (line=#{token.next_code_token.line}, col=#{token.next_code_token.column}) | Do not keep secrets on your scripts as for $#{token.prev_code_token.value} = #{token.next_code_token.value} in line #{token.next_code_token.line}. Store secrets in a vault instead.",
+                     line:    token.next_code_token.line,
+                     column:  token.next_code_token.column,
+                     token:   right_side_value,
+                     cwe: 'CWE-321'
+                  }
+               end
+            end
+         end
+      end
+   end
+end

data/lib/puppet-lint/plugins/check_hard_coded_password.rb

@@ -0,0 +1,33 @@
+require 'puppet-lint-infrasecure'
+
+PuppetLint.new_check(:hardcoded_secret_password) do
+   def check
+      # list of known credentials - not considered secrets by the community (https://puppet.com/docs/pe/2019.8/what_gets_installed_and_where.html#user_and_group_accounts_installed)
+      user_default = ['pe-puppet', 'pe-webserver', 'pe-puppetdb', 'pe-postgres', 'pe-console-services', 'pe-orchestration-services','pe-ace-server', 'pe-bolt-server']
+      # some were advised by puppet specialists
+      invalid_values = ['undefined', 'unset', 'www-data', 'wwwrun', 'www', 'no', 'yes', '[]', 'undef', 'true', 'false', 'changeit', 'changeme', 'root', 'admin', 'none']
+
+      tokens.each do |token|
+         next if token.next_code_token.nil?
+         next if token.prev_code_token.nil?
+         # accepts (<VARIABLE>|<NAME>) (<EQUALS>|<FARROW>) !(<STRING>|<SSTRING>)
+         if [:VARIABLE, :NAME].include? token.prev_code_token.type and [:EQUALS, :FARROW].include? token.type and [:STRING, :SSTRING].include? token.next_code_token.type
+            left_side_value = token.prev_code_token.value.downcase
+            right_side_value = token.next_code_token.value.downcase
+
+            if left_side_value =~ Rules.password and !(left_side_value =~ Rules.nonsecret)
+
+               if !(right_side_value =~ Rules.placeholder) and right_side_value.length > 1 and !right_side_value[/\/.*(\/)+/] and !(user_default.include? right_side_value) and !(invalid_values.include? right_side_value)
+                     notify :warning, {
+                        message: "[SECURITY][CWE-259] Hard Coded Password (line=#{token.next_code_token.line}, col=#{token.next_code_token.column}) | Do not keep secrets on your scripts as for $#{token.prev_code_token.value} = #{token.next_code_token.value} in line #{token.next_code_token.line}. Store secrets in a vault instead.",
+                        line:    token.next_code_token.line,
+                        column:  token.next_code_token.column,
+                        token:   token.next_code_token.value,
+                        cwe: 'CWE-259'
+                     }
+               end
+            end
+         end
+      end
+   end
+end

data/lib/puppet-lint/plugins/check_hard_coded_secret.rb

@@ -5,25 +5,27 @@ PuppetLint.new_check(:hardcoded_secret) do
       # list of known credentials - not considered secrets by the community (https://puppet.com/docs/pe/2019.8/what_gets_installed_and_where.html#user_and_group_accounts_installed)
       user_default = ['pe-puppet', 'pe-webserver', 'pe-puppetdb', 'pe-postgres', 'pe-console-services', 'pe-orchestration-services','pe-ace-server', 'pe-bolt-server']
       # some were advised by puppet specialists
-      invalid_values = ['undefined', 'unset', 'www-data', 'wwwrun', 'www', 'no', 'yes', '[]', 'root']
-      ftokens = filter_tokens(tokens)
-      ftokens.each do |token|
+      invalid_values = ['undefined', 'unset', 'www-data', 'wwwrun', 'www', 'no', 'yes', '[]', 'undef', 'true', 'false', 'changeit', 'changeme', 'root', 'admin', 'none']
+
+      tokens.each do |token|
          next if token.next_code_token.nil?
-         token_value = token.value.downcase
-         token_type = token.type
-         next_token = token.next_code_token
-         # accepts <VARIABLE> <EQUALS> secret OR <NAME> <FARROW> secret, checks if <VARIABLE> | <NAME> satisfy SECRETS but not satisfy NON_SECRETS 
-         if [:VARIABLE, :NAME].include? token_type and [:EQUALS, :FARROW].include? next_token.type and token_value =~ Rules.secret and !(token_value =~ Rules.nonsecret)
-            right_side_type = next_token.next_code_token.type
-            right_side_value = next_token.next_code_token.value.downcase
-            if [:STRING, :SSTRING].include? right_side_type and right_side_value.length > 1 and !invalid_values.include? right_side_value and !(right_side_value =~ /::|\/|\.|\\/ ) and !user_default.include? right_side_value
-               notify :warning, {
-                  message: "[SECURITY] Hard Coded Secret (line=#{next_token.next_code_token.line}, col=#{next_token.next_code_token.column}) | Do not keep secrets on your scripts as for $#{token_value} = #{right_side_value} in #{next_token.next_code_token.line}. Use kms/heira/vault instead.",
-                  line:    next_token.next_code_token.line,
-                  column:  next_token.next_code_token.column,
-                  token:   right_side_value,
-                  cwe: 'CWE-798'
-               }
+         next if token.prev_code_token.nil?
+         # accepts (<VARIABLE>|<NAME>) (<EQUALS>|<FARROW>) !(<STRING>|<SSTRING>)
+         if [:VARIABLE, :NAME].include? token.prev_code_token.type and [:EQUALS, :FARROW].include? token.type and [:STRING, :SSTRING].include? token.next_code_token.type
+            left_side_value = token.prev_code_token.value.downcase
+            right_side_value = token.next_code_token.value.downcase
+            
+            if left_side_value =~ Rules.secret and !(left_side_value =~ Rules.nonsecret)
+
+               if !(right_side_value =~ Rules.placeholder) and right_side_value.length > 1 and !right_side_value[/\/.*(\/)+/] and !(user_default.include? right_side_value) and !(invalid_values.include? right_side_value)
+                     notify :warning, {
+                        message: "[SECURITY][CWE-798] Hard Coded Secret (line=#{token.next_code_token.line}, col=#{token.next_code_token.column}) | Do not keep secrets on your scripts as for $#{token.prev_code_token.value} = #{token.next_code_token.value} in line #{token.next_code_token.line}. Store secrets in a vault instead.",
+                        line:    token.next_code_token.line,
+                        column:  token.next_code_token.column,
+                        token:   right_side_value,
+                        cwe: 'CWE-798'
+                     }
+               end
             end
          end
       end

data/lib/puppet-lint/plugins/check_hard_coded_username.rb

@@ -0,0 +1,31 @@
+require 'puppet-lint-infrasecure'
+
+PuppetLint.new_check(:hardcoded_secret_username) do
+   def check
+      # list of known credentials - not considered secrets by the community (https://puppet.com/docs/pe/2019.8/what_gets_installed_and_where.html#user_and_group_accounts_installed)
+      user_default = ['pe-puppet', 'pe-webserver', 'pe-puppetdb', 'pe-postgres', 'pe-console-services', 'pe-orchestration-services','pe-ace-server', 'pe-bolt-server']
+      # some were advised by puppet specialists
+      invalid_values = ['undefined', 'unset', 'www-data', 'wwwrun', 'www', 'no', 'yes', '[]', 'undef', 'true', 'false', 'changeit', 'changeme', 'root', 'admin', 'none']
+
+      tokens.each do |token|
+         next if token.next_code_token.nil?
+         next if token.prev_code_token.nil?
+         # accepts (<VARIABLE>|<NAME>) (<EQUALS>|<FARROW>) !(<STRING>|<SSTRING>)
+         if [:VARIABLE, :NAME].include? token.prev_code_token.type and [:EQUALS, :FARROW].include? token.type and [:STRING, :SSTRING].include? token.next_code_token.type
+            left_side_value = token.prev_code_token.value.downcase
+            right_side_value = token.next_code_token.value.downcase
+            if left_side_value =~ Rules.username and !(left_side_value =~ Rules.nonsecret)
+               if !(right_side_value =~ Rules.placeholder) and right_side_value.length > 1 and !right_side_value[/\/.*(\/)+/] and !(user_default.include? right_side_value) and !(invalid_values.include? right_side_value)
+                     notify :warning, {
+                        message: "[SECURITY][CWE-798] Hard Coded Username (line=#{token.next_code_token.line}, col=#{token.next_code_token.column}) | Do not keep secrets on your scripts as for $#{token.prev_code_token.value} = #{token.next_code_token.value} in line #{token.next_code_token.line}. Store secrets in a vault instead.",
+                        line:    token.next_code_token.line,
+                        column:  token.next_code_token.column,
+                        token:   right_side_value,
+                        cwe: 'CWE-798'
+                     }
+               end
+            end
+         end
+      end
+   end
+end

data/lib/puppet-lint/plugins/check_invalid_ip_addr_binding.rb

@@ -2,20 +2,21 @@ require 'puppet-lint-infrasecure'
 
 PuppetLint.new_check(:invalid_ip_addr_binding) do   
    def check
-      ftokens = get_tokens(tokens,"0.0.0.0")
-      ftokens.each do |token|
-         token_value = token.value.downcase
-         if [:EQUALS, :FARROW].include? token.prev_code_token.type 
-            prev_token = token.prev_code_token
-            left_side = prev_token.prev_code_token
-            if token_value =~ Rules.ip_addr_bind and [:VARIABLE, :NAME].include? left_side.type
+      tokens.each do |token|
+         next if token.next_code_token.nil?
+         next if token.prev_code_token.nil?
+         # accepts (<VARIABLE>|<NAME>) (<EQUALS>|<FARROW>) (<STRING>|<SSTRING>)
+         if [:VARIABLE, :NAME].include? token.prev_code_token.type and [:EQUALS, :FARROW].include? token.type and [:STRING, :SSTRING].include? token.next_code_token.type
+            left_side_value = token.prev_code_token.value.downcase
+            right_side_value = token.next_code_token.value.downcase
+            if right_side_value =~ Rules.ip_addr_bind
                notify :warning, {
-               message: "[SECURITY] Invalid IP Address Binding (line=#{token.line}, col=#{token.column}) | Don\'t bind your host to #{token_value}. This config allows connections from every possible network. Restrict your available IPs.",
-               line:    token.line,
-               column:  token.column,
-               token:   token_value,
+               message: "[SECURITY][CWE-284] Invalid IP Address Binding (line=#{token.next_code_token.line}, col=#{token.next_code_token.column}) | Don\'t bind your host to #{token.next_code_token.value}. This config allows connections from every possible network. Restrict your available IPs.",
+               line:    token.next_code_token.line,
+               column:  token.next_code_token.column,
+               token:   token.next_code_token.value,
                cwe: 'CWE-284'
-            }
+               }
             end
          end
       end

data/lib/puppet-lint/plugins/check_malicious_dependency.rb

@@ -12,11 +12,11 @@ PuppetLint.new_check(:malicious_dependency) do
          cves = get_malicious_cves(dependency, version)
          if !cves.nil?
             notify :warning, {
-               message: "[SECURITY] Malicious Dependency (line=#{token[:token].line}, col=#{token[:token].column}) | This software is using a third-party library/software (#{dependency} v#{version}) affected by known CVEs (#{cves.join(', ')}).",
+               message: "[SECURITY][CWE-829] Malicious Dependency (line=#{token[:token].line}, col=#{token[:token].column}) | This software is using a third-party library/software (#{dependency} v#{version}) affected by known CVEs (#{cves.join(', ')}).",
                line: token[:token].line,
                column: token[:token].column,
                token: token[:token].prev_code_token.value.downcase,
-               cwe: "CWE-829"
+               cwe: 'CWE-829'
             }
          end
       end

data/lib/puppet-lint/plugins/check_suspicious_comment.rb

@@ -5,9 +5,9 @@ PuppetLint.new_check(:suspicious_comment) do
       ftokens = get_comments(tokens)
       ftokens.each do |token|
          token_value = token.value.downcase
-         if (token_value =~ Rules.susp_comment)
+         if ([:COMMENT, :MLCOMMENT, :SLASH_COMMENT].include? token.type) and (token_value =~ Rules.susp_comment)
             notify :warning, {
-               message: "[SECURITY] Suspicious Comment (line=#{token.line}, col=#{token.column}) | Avoid doing comments containing info about a defect, missing functionality or weakness of the system.",
+               message: "[SECURITY][CWE-546] Suspicious Comment (line=#{token.line}, col=#{token.column}) | Avoid doing comments containing info about a defect, missing functionality or weakness of the system.",
                line: token.line,
                column: token.column,
                token: token_value,

data/lib/puppet-lint/plugins/check_use_http_without_tls.rb

@@ -2,25 +2,27 @@ require 'puppet-lint-infrasecure'
 
 PuppetLint.new_check(:use_http_without_tls) do
    def check
-      resources = ['apt::source', '::apt::source', 'wget::fetch', 'yumrepo', 'yum::', 'aptly::mirror', 'util::system_package', 'yum::managed_yumrepo']
-      ptokens = filter_resources(tokens, resources)
-      keywords = ['backport', 'key', 'download', 'uri', 'mirror']
-      ctokens = filter_variables(ptokens, keywords)
       if Config.regex.whitelist
-         wtokens = filter_whitelist(ctokens)
+         wtokens = filter_whitelist(tokens)
       else
-         wtokens = ptokens
+         wtokens = tokens
       end
       wtokens.each do |token|
-         token_value = token.value.downcase
-         if (token_value =~ Rules.http)
-            notify :warning, {
-               message: "[SECURITY] HTTP without TLS (line=#{token.line}, col=#{token.column}) | Do not use HTTP without TLS as in #{token_value}. This may cause a MITM attack.",
+         next if token.next_code_token.nil?
+         next if token.prev_code_token.nil?   
+         # accepts (<VARIABLE>|<NAME>) (<EQUALS>|<FARROW>) (<STRING>|<SSTRING>)
+         if [:EQUALS, :FARROW].include? token.prev_code_token.type and [:STRING, :SSTRING].include? token.type
+            right_side_value = token.value.downcase
+         
+            if (right_side_value =~ Rules.http)
+               notify :warning, {
+               message: "[SECURITY][CWE-319] HTTP without TLS (line=#{token.line}, col=#{token.column}) | Do not use HTTP without TLS as in #{token.value}. This may cause a MITM attack.",
                line: token.line,
                column: token.column,
-               token: token_value,
+               token: token.value,
                cwe: 'CWE-319'
-            }
+               }
+            end
          end
       end
    end

data/lib/puppet-lint/plugins/check_use_of_weak_crypto_algorithm.rb

@@ -9,12 +9,12 @@ PuppetLint.new_check(:use_of_weak_crypto_algorithm) do
          end
          if (token_value =~ Rules.poor_crypto) && (next_token_type.eql? :LPAREN)
             notify :warning, {
-               message: "[SECURITY] Weak Crypto Algorithm (line=#{token.line}, col=#{token.column}) | Do not use #{token_value}, as they have security weakness. Use SHA-512 instead.",
+               message: "[SECURITY][CWE-326] Weak Crypto Algorithm (line=#{token.line}, col=#{token.column}) | Do not use #{token_value}, as they have security weakness. Use SHA-512 instead.",
                line: token.line,
                column: token.column,
                token: token_value,
                cwe: 'CWE-326'
-         }
+            }
          end
       end
    end  

data/lib/puppet-lint/plugins/check_weak_password.rb

@@ -10,15 +10,17 @@ PuppetLint.new_check(:weak_password) do
             next if token.prev_code_token.nil? or token.next_code_token.nil?             
             if [:EQUALS, :FARROW].include? token_type and [:VARIABLE,:NAME].include? token.prev_code_token.type
                 left_side_value = token.prev_code_token.value.downcase
-                right_side_value = token.next_code_token.value.downcase
+                right_side_value = token.next_code_token.value
                 right_side_token = token.next_code_token
-                if left_side_value =~ Rules.password and checker.is_weak?(right_side_value) and right_side_value != '' and token.next_code_token.type == :SSTRING
+                if left_side_value =~ Rules.password and checker.is_weak?(right_side_value) and right_side_value.length > 1 and [:SSTRING, :STRING].include? token.next_code_token.type
+                    pwd_entropy = checker.calculate_entropy(right_side_value)
                     notify :warning, {
-                        message: "[SECURITY] Weak Password (line=#{right_side_token.line}, col=#{right_side_token.column}) | Passwords should be strong to be hard to uncover by hackers (weak_password=#{right_side_value}). In any case, you should use kms/heira/vault to store secrets instead.",
+                        message: "[SECURITY][CWE-521] Weak Password (line=#{right_side_token.line}, col=#{right_side_token.column}) | Passwords should be strong to be hard to uncover by hackers (weak_password=#{right_side_value}, entropy=#{pwd_entropy}). Recommendation is to use a password with at least 18 bits of entropy. In any case, secrets should be stored in services like kms/heira/vault not in plain text.",
                         line:    right_side_token.line,
                         column:  right_side_token.column,
                         token:   right_side_value,
-                        cwe: 'CWE-521'
+                        cwe: 'CWE-521',
+                        entropy: pwd_entropy
                     }
                 end
              end

data/lib/puppet-lint-infrasecure/config/default.yml

@@ -0,0 +1,21 @@
+user-default:
+  - pe-puppetpe-webserver
+  - pe-puppetdb
+  - pe-postgres
+  - pe-console-services
+  - pe-orchestration-services
+  - pe-ace-server
+  - pe-bolt-server
+
+invalid-values:
+  - undefined
+  - unset
+  - www-data
+  - wwwrun
+  - www
+  - no
+  - yes
+  - []
+  - undef
+  - true
+  - false

data/lib/puppet-lint-infrasecure/rules.rb

@@ -17,22 +17,39 @@ module Rules
       @password ||= /pass(word|_|$)|pwd/
     end
 
-    def self.credentials
-        @credentials ||= /user|usr|pass(word|_|$)|pwd/
+    def self.secret
+        @secret ||= /user|usr|pass(word|_|$)|pwd|(pvt|priv)+.*(cert|key|rsa|secret|ssl)+/
     end
 
-    def self.cyrillic
-        @cyrillic ||= /^(http(s)?:\/\/)?.*\p{Cyrillic}+/
+    def self.key
+        @key ||= /(cert|key|rsa|secret|ssl)+/
     end
 
-    def self.secret
-        @secret ||= /user|usr|pass(word|_|$)|pwd|key|secret/
+    def self.privkey
+        @key ||= /(pvt|priv)+.*(cert|key|rsa|secret|ssl)+/
+    end
+
+
+    def self.username
+        @username ||= /user|usr/
     end
 
     def self.nonsecret
         @nonsecret ||= /gpg|path|type|buff|zone|mode|tag|header|scheme|length|guid/
     end
 
+    def self.credentials
+        @credentials ||= /user|usr|pass(word|_|$)|pwd/
+    end
+
+    def self.placeholder
+        @placeholder ||= /\${.*}|(\$)?.*::.*(::)?/
+    end
+
+    def self.cyrillic
+        @cyrillic ||= /^(http(s)?:\/\/)?.*\p{Cyrillic}+/
+    end
+
     def self.ip_addr_bind
         @ip_addr_bind ||= /^((http(s)?:\/\/)?0.0.0.0(:\d{1,5})?)$/
     end

data/lib/puppet-lint-infrasecure/version.rb

@@ -1,3 +1,3 @@
 class InfraSecure
-    VERSION = '1.1.0'
+    VERSION = '1.2.0'
 end

data/spec/puppet-lint/plugins/check_admin_by_default_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'admin_by_default' do
-    let(:msg) { '[SECURITY] Admin by default (line=6, col=24) | Do not make user/password as admin as for $user in line 6. This can be easily exploited.' }
+    let(:msg) { '[SECURITY][CWE-250] Admin by default (line=6, col=22) | Do not make user as admin as for $user in line 6. This can be easily exploited.' }
     
     context 'with fix disabled' do
         context 'user configuration as admin' do
@@ -11,7 +11,7 @@ describe 'admin_by_default' do
         $auth_server = '127.0.0.1',
         $tenant      = 'openstack',
         $user        = 'admin'
-
+        $admin_user      = 'admin',
     ) {
         include swift::deps
           
@@ -27,7 +27,7 @@ describe 'admin_by_default' do
             end
   
             it 'should create a warning for svnwc user config' do
-                expect(problems).to contain_warning(msg).on_line(6).in_column(24)
+                expect(problems).to contain_warning(msg).on_line(6).in_column(22)
             end
         end
     end

data/spec/puppet-lint/plugins/check_cyrillic_homograph_attack_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'cyrillic_homograph_attack' do
-    let(:msg) {'[SECURITY] Homograph Attack (line=2, col=35). This link (https://www.аpple.com/phish) has a cyrillic char. These are not rendered by browsers and are sometimes used for phishing attacks.' }
+    let(:msg) {'[SECURITY][CWE-1007] Homograph Attack (line=2, col=35). This link (https://www.аpple.com/phish) has a cyrillic char. These chars are not rendered by browsers and are sometimes used for phishing attacks. It can also result in typosquatting attacks.' }
     
     context 'with fix disabled' do
         context 'homograph attack using cyrillic chars not rendered by normal browsers' do

data/spec/puppet-lint/plugins/check_empty_password_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'empty_password' do
-    let(:msg) { '[SECURITY] Empty Password (line=12, col=32) | Do not keep the password field empty as for $password in line 12. Use kms/heira/vault instead.' }
+    let(:msg) { '[SECURITY][CWE-258] Empty Password (line=12, col=32) | Do not keep the password field empty as for $password in line 12. Use a stronger password.' }
     
     context 'with fix disabled' do
         context 'code configuration using empty passwords' do

data/spec/puppet-lint/plugins/check_hard_coded_key_spec.rb

@@ -0,0 +1,54 @@
+require 'spec_helper'
+
+describe 'hardcoded_secret_key' do
+    let(:msg) { '[SECURITY][CWE-321] Hard Coded Key (line=19, col=28) | Do not keep secrets on your scripts as for $private_ssl_key = D868325 in line 19. Store secrets in a vault instead.' }
+    
+    context 'with fix disabled' do
+        context 'code contains hard coded usernames' do
+            let(:code) { "
+    class apmirror (
+        $uid            = 508,
+        $gid            = 508,
+        $group_present  = 'present',
+        $groupname      = 'apmirror',
+        $groups         = [],
+        $service_ensure = 'running',
+        $cert          = '/bin/bash',
+        $username_password       = 'apmirror',
+        $packages       = ['libwww-perl', 'libnet-dns-perl'],
+    ){
+        package { $packages:
+            ensure => present,
+        }
+
+        $cert_generation_class      = '::puppet::puppetserver::generate_cert'
+
+        $private_ssl_key = 'D868325'
+        $pwd = $cert
+        $pwd = 'pe-puppet'
+          
+        user { $username:
+            ensure     => $user_present,
+            name       => $username,
+            home       => '/home/${username}',
+            shell      => $shell,
+            uid        => $uid,
+            gid        => $groupname,
+            groups     => $groups,
+            managehome => true,
+            require    => [ Group[$groupname], Group[$apbackup::username] ],
+        }
+
+    }
+    " }
+  
+            it 'should detect one problem' do
+                expect(problems).to have(1).problem
+            end
+  
+            it 'should create a warning for username hard coded config' do
+                expect(problems).to contain_warning(msg).on_line(19).in_column(28)
+            end
+        end
+    end
+end

data/spec/puppet-lint/plugins/check_hard_coded_password_spec.rb

@@ -0,0 +1,54 @@
+require 'spec_helper'
+
+describe 'hardcoded_secret_password' do
+    let(:msg) { '[SECURITY][CWE-259] Hard Coded Password (line=10, col=36) | Do not keep secrets on your scripts as for $username_password = apmirror in line 10. Store secrets in a vault instead.' }
+    
+    context 'with fix disabled' do
+        context 'code contains hard coded usernames' do
+            let(:code) { "
+    class apmirror (
+        $uid            = 508,
+        $gid            = 508,
+        $group_present  = 'present',
+        $groupname      = 'apmirror',
+        $groups         = [],
+        $service_ensure = 'running',
+        $cert          = '/bin/bash',
+        $username_password       = 'apmirror',
+        $packages       = ['libwww-perl', 'libnet-dns-perl'],
+    ){
+        package { $packages:
+            ensure => present,
+        }
+
+        $cert_generation_class      = '::puppet::puppetserver::generate_cert'
+
+        $pwd = undef
+        $pwd = $cert
+        $pwd = 'pe-puppet'
+          
+        user { $username:
+            ensure     => $user_present,
+            name       => $username,
+            home       => '/home/${username}',
+            shell      => $shell,
+            uid        => $uid,
+            gid        => $groupname,
+            groups     => $groups,
+            managehome => true,
+            require    => [ Group[$groupname], Group[$apbackup::username] ],
+        }
+
+    }
+    " }
+  
+            it 'should detect one problem' do
+                expect(problems).to have(1).problem
+            end
+  
+            it 'should create a warning for username hard coded config' do
+                expect(problems).to contain_warning(msg).on_line(10).in_column(36)
+            end
+        end
+    end
+end

data/spec/puppet-lint/plugins/check_hard_coded_secret_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'hardcoded_secret' do
-    let(:msg) { '[SECURITY] Hard Coded Secret (line=10, col=27) | Do not keep secrets on your scripts as for $username = apmirror in 10. Use kms/heira/vault instead.' }
+    let(:msg) { '[SECURITY][CWE-798] Hard Coded Secret (line=10, col=36) | Do not keep secrets on your scripts as for $username_password = apmirror in line 10. Store secrets in a vault instead.' }
     
     context 'with fix disabled' do
         context 'code contains hard coded usernames' do
@@ -13,8 +13,8 @@ describe 'hardcoded_secret' do
         $groupname      = 'apmirror',
         $groups         = [],
         $service_ensure = 'running',
-        $shell          = '/bin/bash',
-        $username       = 'apmirror',
+        $cert          = '/bin/bash',
+        $username_password       = 'apmirror',
         $packages       = ['libwww-perl', 'libnet-dns-perl'],
     ){
         package { $packages:
@@ -23,7 +23,7 @@ describe 'hardcoded_secret' do
 
         $cert_generation_class      = '::puppet::puppetserver::generate_cert'
 
-        $pwd = 'unset'
+        $pwd = undef
         $pwd = $cert
         $pwd = 'pe-puppet'
           
@@ -38,6 +38,7 @@ describe 'hardcoded_secret' do
             managehome => true,
             require    => [ Group[$groupname], Group[$apbackup::username] ],
         }
+
     }
     " }
   
@@ -46,7 +47,7 @@ describe 'hardcoded_secret' do
             end
   
             it 'should create a warning for username hard coded config' do
-                expect(problems).to contain_warning(msg).on_line(10).in_column(27)
+                expect(problems).to contain_warning(msg).on_line(10).in_column(36)
             end
         end
     end

data/spec/puppet-lint/plugins/check_hard_coded_username_spec.rb

@@ -0,0 +1,54 @@
+require 'spec_helper'
+
+describe 'hardcoded_secret_username' do
+    let(:msg) { '[SECURITY][CWE-798] Hard Coded Username (line=10, col=27) | Do not keep secrets on your scripts as for $username = apmirror in line 10. Store secrets in a vault instead.' }
+    
+    context 'with fix disabled' do
+        context 'code contains hard coded usernames' do
+            let(:code) { "
+    class apmirror (
+        $uid            = 508,
+        $gid            = 508,
+        $group_present  = 'present',
+        $groupname      = 'apmirror',
+        $groups         = [],
+        $service_ensure = 'running',
+        $cert          = '/bin/bash',
+        $username       = 'apmirror',
+        $packages       = ['libwww-perl', 'libnet-dns-perl'],
+    ){
+        package { $packages:
+            ensure => present,
+        }
+
+        $cert_generation_class      = '::puppet::puppetserver::generate_cert'
+
+        $private_ssl_key = 'D868325'
+        $pwd = $cert
+        $pwd = 'pe-puppet'
+          
+        user { $username:
+            ensure     => $user_present,
+            name       => $username,
+            home       => '/home/${username}',
+            shell      => $shell,
+            uid        => $uid,
+            gid        => $groupname,
+            groups     => $groups,
+            managehome => true,
+            require    => [ Group[$groupname], Group[$apbackup::username] ],
+        }
+
+    }
+    " }
+  
+            it 'should detect one problem' do
+                expect(problems).to have(1).problem
+            end
+  
+            it 'should create a warning for username hard coded config' do
+                expect(problems).to contain_warning(msg).on_line(10).in_column(27)
+            end
+        end
+    end
+end

data/spec/puppet-lint/plugins/check_invalid_ip_addr_binding_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'invalid_ip_addr_binding' do
-    let(:msg) {'[SECURITY] Invalid IP Address Binding (line=4, col=30) | Don\'t bind your host to 0.0.0.0. This config allows connections from every possible network. Restrict your available IPs.' }
+    let(:msg) {'[SECURITY][CWE-284] Invalid IP Address Binding (line=4, col=30) | Don\'t bind your host to 0.0.0.0. This config allows connections from every possible network. Restrict your available IPs.' }
     
     context 'with fix disabled' do
         context 'invalid ip adress binding configuration' do

data/spec/puppet-lint/plugins/check_malicious_dependency_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'malicious_dependency' do
-    let(:msg) {'[SECURITY] Malicious Dependency (line=10, col=40) | This software is using a third-party library/software (postgresql v9.4) affected by known CVEs (CVE-2017-12172, CVE-2017-15098, CVE-2017-7484, CVE-2017-7485, CVE-2017-7486, CVE-2017-7546, CVE-2017-7547, CVE-2017-7548, CVE-2016-0766, CVE-2016-0773, CVE-2016-5423, CVE-2016-5424).'}
+    let(:msg) {'[SECURITY][CWE-829] Malicious Dependency (line=10, col=40) | This software is using a third-party library/software (postgresql v9.4) affected by known CVEs (CVE-2017-12172, CVE-2017-15098, CVE-2017-7484, CVE-2017-7485, CVE-2017-7486, CVE-2017-7546, CVE-2017-7547, CVE-2017-7548, CVE-2016-0766, CVE-2016-0773, CVE-2016-5423, CVE-2016-5424).'}
     
     context 'with fix disabled' do
         context 'software uses malicious dependencies' do

data/spec/puppet-lint/plugins/check_suspicious_comment_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'suspicious_comment' do
-    let(:msg) { '[SECURITY] Suspicious Comment (line=8, col=9) | Avoid doing comments containing info about a defect, missing functionality or weakness of the system.' }
+    let(:msg) { '[SECURITY][CWE-546] Suspicious Comment (line=8, col=9) | Avoid doing comments containing info about a defect, missing functionality or weakness of the system.' }
     
     context 'with fix disabled' do
         context 'code with suspicious comment' do

data/spec/puppet-lint/plugins/check_use_http_without_tls_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'use_http_without_tls' do
-    let(:msg) { '[SECURITY] HTTP without TLS (line=2, col=23) | Do not use HTTP without TLS as in http://localhost:2021. This may cause a MITM attack.' }
+    let(:msg) { '[SECURITY][CWE-319] HTTP without TLS (line=2, col=23) | Do not use HTTP without TLS as in http://localhost:2021. This may cause a MITM attack.' }
   
     context 'with fix disabled' do
         context 'configuration using http' do
@@ -89,7 +89,7 @@ describe 'use_http_without_tls' do
     " }
   
             it 'should detect a single problem' do
-                expect(problems).to have(1).problem
+                expect(problems).to have(13).problem
             end
   
             it 'should create a warning' do

data/spec/puppet-lint/plugins/check_use_of_weak_crypto_algorithm_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'use_of_weak_crypto_algorithm' do
-    let(:msg) { '[SECURITY] Weak Crypto Algorithm (line=22, col=21) | Do not use sha1, as they have security weakness. Use SHA-512 instead.' }
+    let(:msg) { '[SECURITY][CWE-326] Weak Crypto Algorithm (line=22, col=21) | Do not use sha1, as they have security weakness. Use SHA-512 instead.' }
     
     context 'with fix disabled' do
         context 'code using unsecure algorithms' do

data/spec/puppet-lint/plugins/check_weak_password_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe 'weak_password' do
-    let(:msg) { '[SECURITY] Weak Password (line=9, col=20) | Passwords should be strong to be hard to uncover by hackers (weak_password=12345678). In any case, you should use kms/heira/vault to store secrets instead.' }
+    let(:msg) { '[SECURITY][CWE-521] Weak Password (line=9, col=20) | Passwords should be strong to be hard to uncover by hackers (weak_password=12345678, entropy=10). Recommendation is to use a password with at least 18 bits of entropy. In any case, secrets should be stored in services like kms/heira/vault not in plain text.' }
     
     context 'with fix disabled' do
         context 'code using weak password' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppet-lint-infrasecure
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Sofia Reis
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-26 00:00:00.000000000 Z
+date: 2022-06-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: puppet-lint
@@ -186,6 +186,7 @@ extra_rdoc_files: []
 files:
 - README.md
 - lib/puppet-lint-infrasecure.rb
+- lib/puppet-lint-infrasecure/config/default.yml
 - lib/puppet-lint-infrasecure/config/dependencies.yml
 - lib/puppet-lint-infrasecure/config/whitelist
 - lib/puppet-lint-infrasecure/dependencies/activemq.json
@@ -228,7 +229,10 @@ files:
 - lib/puppet-lint/plugins/check_admin_by_default.rb
 - lib/puppet-lint/plugins/check_cyrillic_homograph_attack.rb
 - lib/puppet-lint/plugins/check_empty_password.rb
+- lib/puppet-lint/plugins/check_hard_coded_key.rb
+- lib/puppet-lint/plugins/check_hard_coded_password.rb
 - lib/puppet-lint/plugins/check_hard_coded_secret.rb
+- lib/puppet-lint/plugins/check_hard_coded_username.rb
 - lib/puppet-lint/plugins/check_invalid_ip_addr_binding.rb
 - lib/puppet-lint/plugins/check_malicious_dependency.rb
 - lib/puppet-lint/plugins/check_suspicious_comment.rb
@@ -238,7 +242,10 @@ files:
 - spec/puppet-lint/plugins/check_admin_by_default_spec.rb
 - spec/puppet-lint/plugins/check_cyrillic_homograph_attack_spec.rb
 - spec/puppet-lint/plugins/check_empty_password_spec.rb
+- spec/puppet-lint/plugins/check_hard_coded_key_spec.rb
+- spec/puppet-lint/plugins/check_hard_coded_password_spec.rb
 - spec/puppet-lint/plugins/check_hard_coded_secret_spec.rb
+- spec/puppet-lint/plugins/check_hard_coded_username_spec.rb
 - spec/puppet-lint/plugins/check_invalid_ip_addr_binding_spec.rb
 - spec/puppet-lint/plugins/check_malicious_dependency_spec.rb
 - spec/puppet-lint/plugins/check_suspicious_comment_spec.rb
@@ -274,7 +281,10 @@ test_files:
 - spec/puppet-lint/plugins/check_admin_by_default_spec.rb
 - spec/puppet-lint/plugins/check_cyrillic_homograph_attack_spec.rb
 - spec/puppet-lint/plugins/check_empty_password_spec.rb
+- spec/puppet-lint/plugins/check_hard_coded_key_spec.rb
+- spec/puppet-lint/plugins/check_hard_coded_password_spec.rb
 - spec/puppet-lint/plugins/check_hard_coded_secret_spec.rb
+- spec/puppet-lint/plugins/check_hard_coded_username_spec.rb
 - spec/puppet-lint/plugins/check_invalid_ip_addr_binding_spec.rb
 - spec/puppet-lint/plugins/check_malicious_dependency_spec.rb
 - spec/puppet-lint/plugins/check_suspicious_comment_spec.rb