ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase

rules:
  - id: hardcoded-secret-rsa-passphrase
    message: Found the use of an hardcoded passphrase for RSA. The passphrase can be
      easily discovered, and therefore should not be stored in source-code.  It
      is recommended to remove the passphrase from source-code, and use system
      environment variables or a restricted configuration file.
    languages:
      - ruby
    severity: WARNING
    metadata:
      technology:
        - ruby
        - secrets
      category: security
      references:
        - https://cwe.mitre.org/data/definitions/522.html
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      owasp:
        - A07:2021 - Identification and Authentication Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - vuln
      likelihood: MEDIUM
      impact: MEDIUM
      confidence: HIGH
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    patterns:
      - pattern-either:
          - pattern: OpenSSL::PKey::RSA.new(..., '...')
          - pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...')
          - pattern: OpenSSL::PKey::RSA.new(...).export(..., '...')
          - patterns:
              - pattern-inside: |
                  $OPENSSL = OpenSSL::PKey::RSA.new(...)
                  ...
              - pattern-either:
                  - pattern: |
                      $OPENSSL.export(...,'...')
                  - pattern: |
                      $OPENSSL.to_pem(...,'...')
          - patterns:
              - pattern-either:
                  - patterns:
                      - pattern-inside: |
                          $ASSIGN = '...'
                          ...
                          def $METHOD(...)
                          ...
                          end
                          ...
                      - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
                  - patterns:
                      - pattern-inside: |
                          def $METHOD1(...)
                          ...
                          $ASSIGN = '...'
                          ...
                          end
                          ...
                          def $METHOD2(...)
                          ...
                          end
                      - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
                  - patterns:
                      - pattern-inside: |
                          $ASSIGN = '...'
                          ...
                          def $METHOD(...)
                            $OPENSSL = OpenSSL::PKey::RSA.new(...)
                          ...
                          end
                          ...
                      - pattern-either:
                          - pattern: $OPENSSL.export(...,$ASSIGN)
                          - pattern: $OPENSSL.to_pem(...,$ASSIGN)
                  - patterns:
                      - pattern-inside: |
                          def $METHOD1(...)
                          ...
                          $OPENSSL = OpenSSL::PKey::RSA.new(...)
                          ...
                          $ASSIGN = '...'
                          ...
                          end
                          ...
                      - pattern-either:
                          - pattern: $OPENSSL.export(...,$ASSIGN)
                          - pattern: $OPENSSL.to_pem(...,$ASSIGN)
                  - patterns:
                      - pattern-inside: |
                          def $METHOD1(...)
                          ...
                          $ASSIGN = '...'
                          ...
                          end
                          ...
                          def $METHOD2(...)
                          ...
                          $OPENSSL = OpenSSL::PKey::RSA.new(...)
                          ...
                          end
                          ...
                      - pattern-either:
                          - pattern: $OPENSSL.export(...,$ASSIGN)
                          - pattern: $OPENSSL.to_pem(...,$ASSIGN)