ishangsf/rspec
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
rspec/rules/S6292/secrets/rule.adoc

55 lines
1.4 KiB
Plaintext
Raw Permalink Normal View History

APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
include::../../../shared_content/secrets/description.adoc[]
migrate rule descriptions to new education format
2023-05-03 11:06:20 +02:00
== Why is this an issue?
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
include::../../../shared_content/secrets/rationale.adoc[]
Export comments and rspec-to-rspec links from jira
2021-06-02 20:44:38 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
=== What is the potential impact?
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
If your application interacts with Amazon MWS then it requires credentials to
access all the resources it needs to function properly. +
The credentials authenticate to a seller account which can have access to
resources like products, orders, price or shipment information.
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
Below are some real-world scenarios that illustrate some impacts of an attacker
exploiting the secret.
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
:secret_type: secret
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
include::../../../shared_content/secrets/impact/banking_financial_loss.adoc[]
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
include::../../../shared_content/secrets/impact/phishing.adoc[]
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
include::../../../shared_content/secrets/impact/malware_distribution.adoc[]
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
include::../../../shared_content/secrets/impact/suspicious_activities_termination.adoc[]
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
== How to fix it
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
Only administrators should have access to the MWS credentials used by your
application.
include::../../../shared_content/secrets/fix/revoke.adoc[]
include::../../../shared_content/secrets/fix/vault.adoc[]
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
=== Code examples
Export comments and rspec-to-rspec links from jira
2021-06-02 20:44:38 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
:example_secret: amzn.mws.3b8be74a-5f63-5770-5bad-19bd40c0ac65
:example_name: mws-key
:example_env: MWS_KEY
RULEAPI-666: Migrate the "List of parameters", "Highlighting" and "Message" fields from jira RSPEC (#346)
2021-09-20 15:38:42 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
include::../../../shared_content/secrets/examples.adoc[]
RULEAPI-666: Migrate the "List of parameters", "Highlighting" and "Message" fields from jira RSPEC (#346)
2021-09-20 15:38:42 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
//=== How does this work?
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
//=== Pitfalls
//=== Going the extra mile
== Resources
Inline adoc when include has no additional value (#1940) Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
2023-05-25 14:18:12 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
include::../../../shared_content/secrets/resources/standards.adoc[]
RULEAPI-666: Migrate the "List of parameters", "Highlighting" and "Message" fields from jira RSPEC (#346)
2021-09-20 15:38:42 +02:00
APPSEC-1061 Modify S6292(secrets): Make text compliant (#3008) ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-07 16:57:08 +02:00
//=== Benchmarks
Reference in New Issue Copy Permalink