ajinabraham.njsscan.generic.hardcoded_passport.hardcoded_passport_secret
ajinabrahamAuthor
unknown
Download Count*
License
Hardcoded plain text secret used for Passport Strategy. Store it properly in an environment variable.
Run Locally
Run in CI
Defintion
rules:
- id: hardcoded_passport_secret
pattern-either:
- pattern: |
$F = require("passport-auth0").Strategy;
...
new $F({clientSecret: "..."}, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
var $P = {clientSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
var $S = "...";
...
new $F({clientSecret: $S}, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
var $S = "...";
...
$P.clientSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
var $S = "...";
...
var $P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
$P.clientSecret = "...";
...
new $F($P, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
$P = {clientSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
$S = "...";
...
new $F({clientSecret: $S}, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
$S = "...";
...
var $P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
$S = "...";
...
$P.clientSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-auth0").Strategy;
...
$S = "...";
...
$P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
new $F({clientSecret: "..."}, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
var $P = {clientSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
var $S = "...";
...
new $F({clientSecret: $S}, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
var $S = "...";
...
$P.clientSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
var $S = "...";
...
var $P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
$P.clientSecret = "...";
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
$P = {clientSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
$S = "...";
...
new $F({clientSecret: $S}, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
$S = "...";
...
var $P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
$S = "...";
...
$P.clientSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth2").Strategy;
...
$S = "...";
...
$P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
new $F({secretOrKey: "..."}, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
var $P = {secretOrKey: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
var $S = "...";
...
new $F({secretOrKey: $S}, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
var $S = "...";
...
$P.secretOrKey = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
var $S = "...";
...
var $P = {secretOrKey: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
$P.secretOrKey = "...";
...
new $F($P, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
$P = {secretOrKey: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
$S = "...";
...
new $F({secretOrKey: $S}, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
$S = "...";
...
var $P = {secretOrKey: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
$S = "...";
...
$P.secretOrKey = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-jwt").Strategy;
...
$S = "...";
...
$P = {secretOrKey: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
new $F({consumerSecret: "..."}, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
var $P = {consumerSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
var $S = "...";
...
new $F({consumerSecret: $S}, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
var $S = "...";
...
$P.consumerSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
var $S = "...";
...
var $P = {consumerSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
$P.consumerSecret = "...";
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
$P = {consumerSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
$S = "...";
...
new $F({consumerSecret: $S}, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
$S = "...";
...
var $P = {consumerSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
$S = "...";
...
$P.consumerSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-google-oauth1").Strategy;
...
$S = "...";
...
$P = {consumerSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
new $F({clientSecret: "..."}, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
var $P = {clientSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
var $S = "...";
...
new $F({clientSecret: $S}, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
var $S = "...";
...
$P.clientSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
var $S = "...";
...
var $P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
$P.clientSecret = "...";
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
$P = {clientSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
$S = "...";
...
new $F({clientSecret: $S}, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
$S = "...";
...
var $P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
$S = "...";
...
$P.clientSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth2").Strategy;
...
$S = "...";
...
$P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
new $F({clientSecret: "..."}, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
var $P = {clientSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
var $S = "...";
...
new $F({clientSecret: $S}, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
var $S = "...";
...
$P.clientSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
var $S = "...";
...
var $P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
$P.clientSecret = "...";
...
new $F($P, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
$P = {clientSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
$S = "...";
...
new $F({clientSecret: $S}, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
$S = "...";
...
var $P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
$S = "...";
...
$P.clientSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-facebook").Strategy;
...
$S = "...";
...
$P = {clientSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
new $F({consumerSecret: "..."}, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
var $P = {consumerSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
var $S = "...";
...
new $F({consumerSecret: $S}, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
var $S = "...";
...
$P.consumerSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
var $S = "...";
...
var $P = {consumerSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
$P.consumerSecret = "...";
...
new $F($P, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
$P = {consumerSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
$S = "...";
...
new $F({consumerSecret: $S}, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
$S = "...";
...
var $P = {consumerSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
$S = "...";
...
$P.consumerSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-twitter").Strategy;
...
$S = "...";
...
$P = {consumerSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
new $F({consumerSecret: "..."}, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
var $P = {consumerSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
var $S = "...";
...
new $F({consumerSecret: $S}, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
var $S = "...";
...
$P.consumerSecret = $S;
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
var $S = "...";
...
var $P = {consumerSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
$P.consumerSecret = "...";
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
$P = {consumerSecret: "..."};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
$S = "...";
...
new $F({consumerSecret: $S}, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
$S = "...";
...
var $P = {consumerSecret: $S};
...
new $F($P, ...)
- pattern: |
$F = require("passport-oauth1").Strategy;
...
$S = "...";
...
$P.consumerSecret = $S;
...
new $F($P, ...)
- pattern: |-
$F = require("passport-oauth1").Strategy;
...
$S = "...";
...
$P = {consumerSecret: $S};
...
new $F($P, ...)
message: Hardcoded plain text secret used for Passport Strategy. Store it
properly in an environment variable.
metadata:
cwe: cwe-522
owasp-web: a2
license: LGPL-3.0-or-later
vulnerability_class:
- Other
languages:
- javascript
severity: ERROR
Short Link: https://sg.run/Px2W