Create rule S7175: Linear API keys should not be disclosed (#4594)
This commit is contained in:
parent
56cf51e747
commit
aa709674da
2
rules/S7175/metadata.json
Normal file
2
rules/S7175/metadata.json
Normal file
@ -0,0 +1,2 @@
|
||||
{
|
||||
}
|
56
rules/S7175/secrets/metadata.json
Normal file
56
rules/S7175/secrets/metadata.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"title": "Linear API keys should not be disclosed",
|
||||
"type": "VULNERABILITY",
|
||||
"code": {
|
||||
"impacts": {
|
||||
"SECURITY": "HIGH"
|
||||
},
|
||||
"attribute": "TRUSTWORTHY"
|
||||
},
|
||||
"status": "ready",
|
||||
"remediation": {
|
||||
"func": "Constant\/Issue",
|
||||
"constantCost": "30min"
|
||||
},
|
||||
"tags": [
|
||||
"cwe",
|
||||
"cert"
|
||||
],
|
||||
"defaultSeverity": "Blocker",
|
||||
"ruleSpecification": "RSPEC-7175",
|
||||
"sqKey": "S7175",
|
||||
"scope": "All",
|
||||
"securityStandards": {
|
||||
"CWE": [
|
||||
798,
|
||||
259
|
||||
],
|
||||
"OWASP": [
|
||||
"A3"
|
||||
],
|
||||
"CERT": [
|
||||
"MSC03-J."
|
||||
],
|
||||
"OWASP Top 10 2021": [
|
||||
"A7"
|
||||
],
|
||||
"PCI DSS 3.2": [
|
||||
"6.5.10"
|
||||
],
|
||||
"PCI DSS 4.0": [
|
||||
"6.2.4"
|
||||
],
|
||||
"ASVS 4.0": [
|
||||
"2.10.4",
|
||||
"3.5.2",
|
||||
"6.4.1"
|
||||
],
|
||||
"STIG ASD_V5R3": [
|
||||
"V-222642"
|
||||
]
|
||||
},
|
||||
"defaultQualityProfiles": [
|
||||
"Sonar way"
|
||||
],
|
||||
"quickfix": "unknown"
|
||||
}
|
33
rules/S7175/secrets/rule.adoc
Normal file
33
rules/S7175/secrets/rule.adoc
Normal file
@ -0,0 +1,33 @@
|
||||
|
||||
include::../../../shared_content/secrets/description.adoc[]
|
||||
|
||||
== Why is this an issue?
|
||||
|
||||
include::../../../shared_content/secrets/rationale.adoc[]
|
||||
|
||||
=== What is the potential impact?
|
||||
|
||||
Below are some real-world scenarios that illustrate some impacts of an attacker
|
||||
exploiting the secret.
|
||||
|
||||
include::../../../shared_content/secrets/impact/financial_loss.adoc[]
|
||||
|
||||
include::../../../shared_content/secrets/impact/data_compromise.adoc[]
|
||||
|
||||
== How to fix it
|
||||
|
||||
include::../../../shared_content/secrets/fix/revoke.adoc[]
|
||||
|
||||
include::../../../shared_content/secrets/fix/vault.adoc[]
|
||||
|
||||
=== Code examples
|
||||
|
||||
:example_secret: lin_oauth_1462cb9a9d462cab2d2992281cb8e94b972cdebe8a33e72067383fd1d4a6ea23
|
||||
:example_name: linear-key
|
||||
:example_env: LINEAR_KEY
|
||||
|
||||
include::../../../shared_content/secrets/examples.adoc[]
|
||||
|
||||
== Resources
|
||||
|
||||
include::../../../shared_content/secrets/resources/standards.adoc[]
|
Loading…
x
Reference in New Issue
Block a user