generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth

Community Favorite
profile photo of returntocorpreturntocorp
Author
32,802
Download Count*
LGPL Commons Clause
License

Facebook OAuth detected

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: detected-facebook-oauth
    pattern-regex: "[fF][aA][cC][eE][bB][oO][oO][kK].*[tT][oO][kK][eE][nN].*['|\"]?\
      [0-9a-f]{32}['|\"]?"
    languages:
      - regex
    message: Facebook OAuth detected
    severity: ERROR
    metadata:
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
      category: security
      technology:
        - secrets
        - facebook
      confidence: LOW
      owasp:
        - A07:2021 - Identification and Authentication Failures
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: MEDIUM
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]

Examples

detected-facebook-oauth.txt

# ruleid: detected-facebook-oauth
https://graph.facebook.com/oauth/access_token?client_id=571605572000175&client_secret=c3cc928991d69e784f69a907000cc909&grant_type=client_credentials

# ok: detected-facebook-oauth
https://github.com/facebook/zstd/blob/12c045f74d922dc934c168f6e1581d72df983388/doc/zstd_compression_format.md