mcp-server-semgrep/semgrep-rules/generic/secrets/security/detected-artifactory-password.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: detected-artifactory-password
    patterns:
      - pattern-regex: (?<ITEM>\bAP[\dABCDEF][a-zA-Z0-9]{8,})
      - pattern-regex: .*(?i)arti[-_]?factory.*
      - pattern-not-regex: .*(?i)sha(1|2|3|118|256|512).*
      - pattern-not-regex: (?i)-----\s*?BEGIN[ A-Z0-9_-]*? KEY( BLOCK)?-----[\s\S]*?-----\s*?END[ A-Z0-9_-]*?\s*?-----
      - metavariable-analysis:
          analyzer: entropy
          metavariable: $ITEM
      - pattern-not-regex: (\w|\.|\*)\1{4}
    languages:
      - regex
    paths:
      exclude:
        - "*.svg"
        - "*go.sum"
        - "*package.json"
        - "*cargo.lock"
        - "*package-lock.json"
        - "*bundle.js"
        - "*pnpm-lock*"
        - "*Podfile.lock"
        - "*/openssl/*.h"
        - "*.xcscmblueprint"
    message: Artifactory token detected
    severity: ERROR
    metadata:
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/artifactory.py
      category: security
      technology:
        - secrets
        - artifactory
      confidence: LOW
      owasp:
        - A07:2021 - Identification and Authentication Failures
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: HIGH