generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret

Community Favorite
profile photo of semgrepsemgrep
Author
37,965
Download Count*

Square OAuth Secret detected

Run Locally

Run in CI

Defintion

rules:
  - id: detected-square-oauth-secret
    pattern-regex: sq0csp-[0-9A-Za-z\\\-_]{43}
    languages:
      - regex
    message: Square OAuth Secret detected
    severity: ERROR
    metadata:
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
      references:
        - https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py
      category: security
      technology:
        - secrets
        - square
      confidence: LOW
      owasp:
        - A07:2021 - Identification and Authentication Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: MEDIUM
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Hard-coded Secrets

Examples

detected-square-oauth-secret.txt

# ruleid: detected-square-oauth-secret
sq0csp-0123456789abcdefghijklmnopqrstuvwxyz-blah_x

# ruleid: detected-square-oauth-secret
square_oauth = sq0csp-ABCDEFGHIJK_LMNOPQRSTUVWXYZ-0123456789\abcd