class HardCodedCredentialsRule

Public Class Methods

AnalyzeTokens(tokens) click to toggle source
# File lib/rules/hard_coded_credentials_rule.rb, line 18
def self.AnalyzeTokens(tokens)
  result = []

  ftokens = self.filter_tokens(tokens)
  ftokens.each do |token|
    token_value = token.value.downcase
    token_type = token.type.to_s
    next_token = token.next_code_token
    # accepts <VARIABLE> <EQUALS> secret OR <NAME> <FARROW> secret, checks if <VARIABLE> | <NAME> satisfy SECRETS but not satisfy NON_SECRETS
    if ["VARIABLE", "NAME"].include? token_type and ["EQUALS", "FARROW"].include? next_token.type.to_s and token_value =~ @secrets_conf.value and !(token_value =~ @non_secrets_conf.value)
      right_side_type = next_token.next_code_token.type.to_s
      right_side_value = next_token.next_code_token.value.downcase
      if ["STRING", "SSTRING"].include? right_side_type and right_side_value.length > 1 and !@invalid_values_conf.value.include? right_side_value and !(right_side_value =~ /::|\/|\.|\\/ ) and !@not_considered_creds_conf.value.include? right_side_value
        result.append(Sin.new(SinType::HardCodedCred, token.line, token.column, next_token.next_code_token.line, next_token.next_code_token.column+right_side_value.length))
      end
    end
  end

  return result
end