Modification in express-session-hardcoded-secret-typescript

ESS-ENN · ESS-ENN · commit cda340c4bd9f · 2025-01-06T19:02:13.000+05:30
diff --git a/rules/typescript/security/express-session-hardcoded-secret-typescript.yml b/rules/typescript/security/express-session-hardcoded-secret-typescript.yml
@@ -11,6 +11,7 @@ note: >-
   [CWE-798] Use of Hard-coded Credentials.
   [REFERENCES]
       - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+
 rule:
   kind: pair
   all:
@@ -21,8 +22,6 @@ rule:
     - has:
         kind: string
         nthChild: 2
-        has:
-          kind: string_fragment
   inside:
     stopBy: end
     kind: object
@@ -163,7 +162,9 @@ rule:
                             nthChild: 2
                             regex: ^'express-session'$
                     - any:
-                        - kind: lexical_declaration
+                        - any:
+                            - kind: lexical_declaration
+                            - kind: variable_declaration
                           all:
                             - has:
                                 kind: variable_declarator
@@ -175,7 +176,15 @@ rule:
                                   - has:
                                       kind: call_expression
                                       nthChild: 2
-                                      regex: ^require\('express-session'\)$
+                                      all:
+                                        - has:
+                                            nthChild: 1
+                                            kind: identifier
+                                            regex: ^require$
+                                        - has:
+                                            nthChild: 2
+                                            kind: arguments
+                                            regex: ^\('express-session'\)$
                         - kind: expression_statement
                           has:
                             kind: assignment_expression
@@ -187,5 +196,13 @@ rule:
                               - has:
                                   kind: call_expression
                                   nthChild: 2
-                                  regex: ^require\('express-session'\)$
-        
+                                  all:
+                                    - has:
+                                        nthChild: 1
+                                        kind: identifier
+                                        regex: ^require$
+                                    - has:
+                                        nthChild: 2
+                                        kind: arguments
+                                        regex: ^\('express-session'\)$
+               
diff --git a/tests/__snapshots__/express-session-hardcoded-secret-typescript-snapshot.yml b/tests/__snapshots__/express-session-hardcoded-secret-typescript-snapshot.yml
@@ -152,6 +152,100 @@ snapshots:
       style: secondary
       start: 81
       end: 137
+  ? |
+    import express from 'express'
+    import session from 'express-session'
+    let secret2 = {
+     resave: false,
+     secret: 'foo',
+     saveUninitialized: false,
+    }
+    app.use(session(secret2));
+  : labels:
+    - source: 'secret: ''foo'''
+      style: primary
+      start: 101
+      end: 114
+    - source: secret
+      style: secondary
+      start: 101
+      end: 107
+    - source: '''foo'''
+      style: secondary
+      start: 109
+      end: 114
+    - source: |-
+        {
+         resave: false,
+         secret: 'foo',
+         saveUninitialized: false,
+        }
+      style: secondary
+      start: 82
+      end: 144
+    - source: secret2
+      style: secondary
+      start: 72
+      end: 79
+    - source: |-
+        secret2 = {
+         resave: false,
+         secret: 'foo',
+         saveUninitialized: false,
+        }
+      style: secondary
+      start: 72
+      end: 144
+    - source: session
+      style: secondary
+      start: 37
+      end: 44
+    - source: session
+      style: secondary
+      start: 37
+      end: 44
+    - source: '''express-session'''
+      style: secondary
+      start: 50
+      end: 67
+    - source: import session from 'express-session'
+      style: secondary
+      start: 30
+      end: 67
+    - source: import session from 'express-session'
+      style: secondary
+      start: 30
+      end: 67
+    - source: secret2
+      style: secondary
+      start: 161
+      end: 168
+    - source: app.use(session(secret2))
+      style: secondary
+      start: 145
+      end: 170
+    - source: app.use(session(secret2))
+      style: secondary
+      start: 145
+      end: 170
+    - source: |-
+        let secret2 = {
+         resave: false,
+         secret: 'foo',
+         saveUninitialized: false,
+        }
+      style: secondary
+      start: 68
+      end: 144
+    - source: |-
+        {
+         resave: false,
+         secret: 'foo',
+         saveUninitialized: false,
+        }
+      style: secondary
+      start: 82
+      end: 144
   ? |
     import express from 'express'
     import session from 'express-session'
diff --git a/tests/typescript/express-session-hardcoded-secret-typescript-test.yml b/tests/typescript/express-session-hardcoded-secret-typescript-test.yml
@@ -1,27 +1,21 @@
 id: express-session-hardcoded-secret-typescript
 valid:
   - |
-    let config1 = {
-    secret: config.secret,
-    resave: false,
-    saveUninitialized: false,
+    import express from 'express'
+    import session from 'express-session'
+    let secret2 = {
+      resave: false,
+      secret: config.secret,
+      saveUninitialized: false,
     }
+    app.use(session(secret2));
 invalid:
   - |
      import express from 'express'
      import session from 'express-session'
      let secret2 = {
-     resave: false,
-     secret: 'foo',
-     saveUninitialized: false,
-     }
-     app.use(session(secret2));
-  - |
-     import express from 'express'
-     import session from 'express-session'
-     let config = {
-     secret: '',
-     resave: false,
-     saveUninitialized: false,
+      resave: false,
+      secret: 'foo',
+      saveUninitialized: false,
      }
      app.use(session(secret2));
