mcp-server-semgrep/semgrep-rules/javascript/passport-jwt/security/passport-hardcode.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: hardcoded-passport-secret
  message: >-
    A hard-coded credential was detected. It is not recommended to store credentials in source-code,
    as this risks secrets
    being leaked and used by either an internal or external malicious adversary. It is recommended to
    use environment variables to securely provide credentials or retrieve credentials from a secure
    vault or HSM (Hardware Security Module).
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A07:2021 - Identification and Authentication Failures
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.5.2 Static API keys or secret
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
      version: '4'
    category: security
    technology:
    - jwt
    - nodejs
    - secrets
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - by-side-effect: true
    patterns:
    - pattern-either:
      - pattern: |
          {..., clientSecret: "...", ...}
      - pattern: |
          {..., secretOrKey: "...", ...}
      - pattern: |
          {..., consumerSecret: "...", ...}
      - patterns:
        - pattern-inside: |
            $OBJ = {}
            ...
        - pattern-either:
          - pattern: |
              $OBJ.clientSecret = "..."
          - pattern: |
              $OBJ.secretOrKey = "..."
          - pattern: |
              $OBJ.consumerSecret = "..."
        - pattern: $OBJ
      - patterns:
        - pattern-inside: |
            $SECRET = '...'
            ...
        - pattern-either:
          - pattern: |
              {..., clientSecret: $SECRET, ...}
          - pattern: |
              {..., secretOrKey: $SECRET, ...}
          - pattern: |
              {..., consumerSecret: $SECRET, ...}
      - patterns:
        - pattern-inside: |
            $SECRET = '...'
            ...
        - pattern-either:
          - pattern-inside: |
              $VALUE = {..., clientSecret: $SECRET, ...}
              ...
          - pattern-inside: |
              $VALUE = {..., secretOrKey: $SECRET, ...}
              ...
          - pattern-inside: |
              $VALUE = {..., consumerSecret: $SECRET, ...}
              ...
        - pattern: $VALUE
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $F = require("$I").Strategy
          ...
      - pattern-inside: |
          $F = require("$I")
          ...
      - pattern-inside: |
          import { $STRAT as $F } from '$I'
          ...
      - pattern-inside: |
          import $F from '$I'
          ...
    - metavariable-regex:
        metavariable: $I
        regex: (passport-.*)
    - pattern-inside: |
        new $F($VALUE,...)
    - focus-metavariable: $VALUE