@duckmind/dm-linux-x64 0.63.9 → 0.64.2

package/extensions/dm-lens/rules/ast-grep-rules/coderabbit/rules/rust/security/tokio-postgres-empty-password-rust.yml

@@ -0,0 +1,235 @@
+id: tokio-postgres-empty-password-rust
+language: rust
+severity: warning
+message: >-
+  The application uses an empty credential. This can lead to unauthorized access by either an internal or external
+  malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware
+  Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.
+note: |-
+  [CWE-287] Improper Authentication. [REFERENCES]
+      - https://docs.rs/tokio-postgres/latest/tokio_postgres/
+      - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+ast-grep-essentials: true
+utils:
+  MATCH_FOLLOW_1:
+    follows:
+      stopBy: end
+      any:
+        - kind: let_declaration
+          all:
+            - has:
+                kind: identifier
+                pattern: $CONFIG
+            - has:
+                kind: call_expression
+                regex: ^tokio_postgres::Config::new\(\)$
+        - kind: let_declaration
+          all:
+            - has:
+                kind: identifier
+                pattern: $CONFIG
+            - has:
+                kind: call_expression
+                regex: ^Config::new\(\)$
+          any:
+            - follows:
+                stopBy: end
+                kind: use_declaration
+                has:
+                  stopBy: end
+                  kind: scoped_identifier
+                  regex: ^tokio_postgres::Config$
+            - inside:
+                stopBy: end
+                follows:
+                  stopBy: end
+                  kind: use_declaration
+                  has:
+                    stopBy: end
+                    kind: scoped_identifier
+                    regex: ^tokio_postgres::Config$
+rule:
+  kind: call_expression
+  not:
+    has:
+      stopBy: end
+      kind: ERROR
+  any:
+    - all:
+        - has:
+            stopBy: end
+            kind: scoped_identifier
+            regex: ^tokio_postgres::Config::new()$
+        - has:
+            kind: field_expression
+            regex: \.password$
+            nthChild: 1
+        - has:
+            kind: arguments
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: string_literal
+              not:
+                has:
+                  kind: string_content
+              nthChild: 1
+            all:
+              - not:
+                  has:
+                    stopBy: end
+                    nthChild: 2
+              - not:
+                  has:
+                    stopBy: end
+                    any:
+                      - kind: block
+                      - kind: array_expression
+    - all:
+        - has:
+            stopBy: end
+            kind: scoped_identifier
+            regex: ^tokio_postgres::Config::new()$
+        - has:
+            kind: field_expression
+            regex: \.password$
+            nthChild: 1
+        - has:
+            kind: arguments
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: identifier
+              pattern: $PASSWORD
+              inside:
+                stopBy: end
+                follows:
+                  stopBy: end
+                  any:
+                    - kind: let_declaration
+                      has:
+                        kind: identifier
+                        pattern: $PASSWORD
+                        precedes:
+                          stopBy: end
+                          kind: string_literal
+                          not:
+                            has:
+                              kind: string_content
+                    - kind: expression_statement
+                      has:
+                        kind: assignment_expression
+                        has:
+                          kind: identifier
+                          pattern: $PASSWORD
+                          precedes:
+                            stopBy: end
+                            kind: string_literal
+                            not:
+                              has:
+                                kind: string_content
+              nthChild: 1
+            all:
+              - not:
+                  has:
+                    stopBy: end
+                    nthChild: 2
+              - not:
+                  has:
+                    stopBy: end
+                    any:
+                      - kind: block
+                      - kind: array_expression
+    - all:
+        - has:
+            stopBy: end
+            kind: identifier
+            pattern: $CONFIG
+            any:
+              - inside:
+                  stopBy: end
+                  matches: MATCH_FOLLOW_1
+        - has:
+            kind: field_expression
+            regex: \.password$
+            nthChild: 1
+        - has:
+            kind: arguments
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: string_literal
+              not:
+                has:
+                  kind: string_content
+              nthChild: 1
+            all:
+              - not:
+                  has:
+                    stopBy: end
+                    nthChild: 2
+              - not:
+                  has:
+                    stopBy: end
+                    any:
+                      - kind: block
+                      - kind: array_expression
+    - all:
+        - has:
+            stopBy: end
+            kind: identifier
+            pattern: $CONFIG
+            any:
+              - inside:
+                  stopBy: end
+                  matches: MATCH_FOLLOW_1
+        - has:
+            kind: field_expression
+            regex: \.password$
+            nthChild: 1
+        - has:
+            kind: arguments
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: identifier
+              pattern: $PASSWORD
+              nthChild: 1
+              inside:
+                stopBy: end
+                follows:
+                  stopBy: end
+                  any:
+                    - kind: let_declaration
+                      all:
+                        - has:
+                            kind: identifier
+                            pattern: $PASSWORD
+                        - has:
+                            kind: string_literal
+                            not:
+                              has:
+                                kind: string_content
+                    - kind: expression_statement
+                      has:
+                        kind: assignment_expression
+                        all:
+                          - has:
+                              kind: identifier
+                              pattern: $PASSWORD
+                          - has:
+                              kind: string_literal
+                              not:
+                                has:
+                                  kind: string_content
+            all:
+              - not:
+                  has:
+                    stopBy: end
+                    nthChild: 2
+              - not:
+                  has:
+                    stopBy: end
+                    any:
+                      - kind: block
+                      - kind: array_expression

package/extensions/dm-lens/rules/ast-grep-rules/coderabbit/rules/rust/security/tokio-postgres-hardcoded-password-rust.yml

@@ -0,0 +1,229 @@
+id: tokio-postgres-hardcoded-password-rust
+language: rust
+severity: warning
+message: >-
+  The application uses an empty credential. This can lead to unauthorized access by either an internal or external
+  malicious actor. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware
+  Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.
+note: |-
+  [CWE-287] Improper Authentication. [REFERENCES]
+      - https://docs.rs/tokio-postgres/latest/tokio_postgres/
+      - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+ast-grep-essentials: true
+utils:
+  MATCH_FOLLOW_1:
+    follows:
+      stopBy: end
+      any:
+        - kind: let_declaration
+          all:
+            - has:
+                kind: identifier
+                pattern: $CONFIG
+            - has:
+                kind: call_expression
+                regex: ^tokio_postgres::Config::new\(\)$
+        - kind: let_declaration
+          all:
+            - has:
+                kind: identifier
+                pattern: $CONFIG
+            - has:
+                kind: call_expression
+                regex: ^Config::new\(\)$
+          any:
+            - follows:
+                stopBy: end
+                kind: use_declaration
+                has:
+                  stopBy: end
+                  kind: scoped_identifier
+                  regex: ^tokio_postgres::Config$
+            - inside:
+                stopBy: end
+                follows:
+                  stopBy: end
+                  kind: use_declaration
+                  has:
+                    stopBy: end
+                    kind: scoped_identifier
+                    regex: ^tokio_postgres::Config$
+rule:
+  kind: call_expression
+  not:
+    has:
+      stopBy: end
+      kind: ERROR
+  any:
+    - all:
+        - has:
+            stopBy: end
+            kind: scoped_identifier
+            regex: ^tokio_postgres::Config::new()$
+        - has:
+            kind: field_expression
+            regex: \.password$
+            nthChild: 1
+        - has:
+            kind: arguments
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: string_literal
+              has:
+                kind: string_content
+              nthChild: 1
+            all:
+              - not:
+                  has:
+                    stopBy: end
+                    nthChild: 2
+              - not:
+                  has:
+                    stopBy: end
+                    any:
+                      - kind: block
+                      - kind: array_expression
+    - all:
+        - has:
+            stopBy: end
+            kind: scoped_identifier
+            regex: ^tokio_postgres::Config::new()$
+        - has:
+            kind: field_expression
+            regex: \.password$
+            nthChild: 1
+        - has:
+            kind: arguments
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: identifier
+              pattern: $PASSWORD
+              inside:
+                stopBy: end
+                follows:
+                  stopBy: end
+                  any:
+                    - kind: let_declaration
+                      has:
+                        kind: identifier
+                        pattern: $PASSWORD
+                        precedes:
+                          stopBy: end
+                          kind: string_literal
+                          has:
+                            kind: string_content
+                    - kind: expression_statement
+                      has:
+                        kind: assignment_expression
+                        has:
+                          kind: identifier
+                          pattern: $PASSWORD
+                          precedes:
+                            stopBy: end
+                            kind: string_literal
+                            has:
+                              kind: string_content
+              nthChild: 1
+            all:
+              - not:
+                  has:
+                    stopBy: end
+                    nthChild: 2
+              - not:
+                  has:
+                    stopBy: end
+                    any:
+                      - kind: block
+                      - kind: array_expression
+    - all:
+        - has:
+            stopBy: end
+            kind: identifier
+            pattern: $CONFIG
+            any:
+              - inside:
+                  stopBy: end
+                  matches: MATCH_FOLLOW_1
+        - has:
+            kind: field_expression
+            regex: \.password$
+            nthChild: 1
+        - has:
+            kind: arguments
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: string_literal
+              has:
+                kind: string_content
+              nthChild: 1
+            all:
+              - not:
+                  has:
+                    stopBy: end
+                    nthChild: 2
+              - not:
+                  has:
+                    stopBy: end
+                    any:
+                      - kind: block
+                      - kind: array_expression
+    - all:
+        - has:
+            stopBy: end
+            kind: identifier
+            pattern: $CONFIG
+            any:
+              - inside:
+                  stopBy: end
+                  matches: MATCH_FOLLOW_1
+        - has:
+            kind: field_expression
+            regex: \.password$
+            nthChild: 1
+        - has:
+            kind: arguments
+            nthChild: 2
+            has:
+              stopBy: end
+              kind: identifier
+              pattern: $PASSWORD
+              nthChild: 1
+              inside:
+                stopBy: end
+                follows:
+                  stopBy: end
+                  any:
+                    - kind: let_declaration
+                      all:
+                        - has:
+                            kind: identifier
+                            pattern: $PASSWORD
+                        - has:
+                            kind: string_literal
+                            has:
+                              kind: string_content
+                    - kind: expression_statement
+                      has:
+                        kind: assignment_expression
+                        all:
+                          - has:
+                              kind: identifier
+                              pattern: $PASSWORD
+                          - has:
+                              kind: string_literal
+                              has:
+                                kind: string_content
+            all:
+              - not:
+                  has:
+                    stopBy: end
+                    nthChild: 2
+              - not:
+                  has:
+                    stopBy: end
+                    any:
+                      - kind: block
+                      - kind: array_expression

package/extensions/dm-lens/rules/ast-grep-rules/coderabbit/rules/scala/security/jwt-scala-hardcode-scala.yml

@@ -0,0 +1,109 @@
+id: jwt-scala-hardcode-scala
+language: scala
+severity: warning
+message: >-
+  Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness:
+  https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the
+  credentials (e.g. keeping secrets in environment variables).
+note: |-
+  [CWE-522] Insufficiently Protected Credentials. [REFERENCES]
+      - https://jwt-scala.github.io/jwt-scala/
+ast-grep-essentials: true
+utils:
+  PATTERN:
+    kind: call_expression
+    all:
+      - inside:
+          stopBy: end
+          follows:
+            stopBy: end
+            kind: import_declaration
+            regex: ^import pdi.jwt.*
+      - has:
+          kind: field_expression
+          all:
+            - has:
+                kind: identifier
+                nthChild: 1
+                regex: ^(Jwt|JwtArgonaut|JwtCirce|JwtJson4s|JwtJson|JwtUpickle)$
+            - has:
+                kind: identifier
+                nthChild: 2
+                regex: ^(encode|decode|decodeRawAll|decodeRaw|decodeAll|validate|isValid|decodeJson|decodeJsonAll)$
+      - has:
+          kind: arguments
+          has:
+            kind: string
+            not:
+              regex: ^""$
+            nthChild:
+              position: 2
+              ofRule:
+                not:
+                  kind: comment
+  PATTERN_with_Instance:
+    kind: call_expression
+    all:
+      - inside:
+          stopBy: end
+          follows:
+            stopBy: end
+            kind: import_declaration
+            regex: ^import pdi.jwt.*
+      - has:
+          kind: field_expression
+          all:
+            - has:
+                kind: identifier
+                nthChild: 1
+                regex: ^(Jwt|JwtArgonaut|JwtCirce|JwtJson4s|JwtJson|JwtUpickle)$
+            - has:
+                kind: identifier
+                nthChild: 2
+                regex: ^(encode|decode|decodeRawAll|decodeRaw|decodeAll|validate|isValid|decodeJson|decodeJsonAll)$
+      - has:
+          kind: arguments
+          any:
+            - has:
+                kind: field_expression
+                all:
+                  - has:
+                      nthChild: 1
+                      regex: ^this$
+                  - has:
+                      nthChild: 2
+                      kind: identifier
+                      pattern: $STRG
+            - has:
+                kind: identifier
+                pattern: $STRG
+                nthChild:
+                  position: 2
+                  ofRule:
+                    not:
+                      kind: comment
+      - inside:
+          stopBy: end
+          follows:
+            stopBy: end
+            kind: val_definition
+            all:
+              - has:
+                  kind: identifier
+                  field: pattern
+                  pattern: $STRG
+              - has:
+                  kind: string
+                  field: value
+                  not:
+                    regex: ^""$
+              - inside:
+                  stopBy: end
+                  any:
+                    - kind: object_definition
+                    - kind: class_definition
+rule:
+  kind: call_expression
+  any:
+    - matches: PATTERN
+    - matches: PATTERN_with_Instance