mcp-server-semgrep/semgrep-rules/ruby/lang/security/hardcoded-secret-rsa-passphrase.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: hardcoded-secret-rsa-passphrase
  message: >-
    Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore
    should not be stored in source-code. It is recommended to remove the passphrase from source-code,
    and use system environment variables or a restricted configuration file.
  languages:
  - ruby
  severity: WARNING
  metadata:
    technology:
    - ruby
    - secrets
    category: security
    references:
    - https://cwe.mitre.org/data/definitions/522.html
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
  patterns:
  - pattern-either:
    - pattern: OpenSSL::PKey::RSA.new(..., '...')
    - pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...')
    - pattern: OpenSSL::PKey::RSA.new(...).export(..., '...')
    - patterns:
      - pattern-inside: |
          $OPENSSL = OpenSSL::PKey::RSA.new(...)
          ...
      - pattern-either:
        - pattern: |
            $OPENSSL.export(...,'...')
        - pattern: |
            $OPENSSL.to_pem(...,'...')
    - patterns:
      - pattern-either:
        - patterns:
          - pattern-inside: |
              $ASSIGN = '...'
              ...
          - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
        - patterns:
          - pattern-inside: |
              def $METHOD1(...)
              ...
              $ASSIGN = '...'
              ...
              end
              ...
              def $METHOD2(...)
              ...
              end
          - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
        - patterns:
          - pattern-inside: |
              $ASSIGN = '...'
              ...
              def $METHOD(...)
                $OPENSSL = OpenSSL::PKey::RSA.new(...)
              ...
              end
              ...
          - pattern-either:
            - pattern: $OPENSSL.export(...,$ASSIGN)
            - pattern: $OPENSSL.to_pem(...,$ASSIGN)
        - patterns:
          - pattern-inside: |
              def $METHOD1(...)
              ...
              $OPENSSL = OpenSSL::PKey::RSA.new(...)
              ...
              $ASSIGN = '...'
              ...
              end
              ...
          - pattern-either:
            - pattern: $OPENSSL.export(...,$ASSIGN)
            - pattern: $OPENSSL.to_pem(...,$ASSIGN)
        - patterns:
          - pattern-inside: |
              def $METHOD1(...)
              ...
              $ASSIGN = '...'
              ...
              end
              ...
              def $METHOD2(...)
              ...
              $OPENSSL = OpenSSL::PKey::RSA.new(...)
              ...
              end
              ...
          - pattern-either:
            - pattern: $OPENSSL.export(...,$ASSIGN)
            - pattern: $OPENSSL.to_pem(...,$ASSIGN)