f283b8c276
You can preview this rule [here](https://sonarsource.github.io/rspec/#/rspec/S6731/secrets) (updated a few minutes after each push). ## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule) --------- Co-authored-by: loris-s-sonarsource <loris-s-sonarsource@users.noreply.github.com> Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com> Co-authored-by: Loris S <91723853+loris-s-sonarsource@users.noreply.github.com>
48 lines
1.2 KiB
Plaintext
48 lines
1.2 KiB
Plaintext
include::../../../shared_content/secrets/description.adoc[]
|
|
|
|
== Why is this an issue?
|
|
|
|
include::../../../shared_content/secrets/rationale.adoc[]
|
|
|
|
=== What is the potential impact?
|
|
|
|
Slack bot tokens have multiple types of access to a channel: They can post
|
|
messages, read usernames and users emails. These links have plethora of possible capabilities.
|
|
|
|
Below are some real-world scenarios that illustrate some impacts of an attacker
|
|
exploiting the secret.
|
|
|
|
:secret_type: token
|
|
|
|
include::../../../shared_content/secrets/impact/phishing.adoc[]
|
|
|
|
include::../../../shared_content/secrets/impact/malware_distribution.adoc[]
|
|
|
|
include::../../../shared_content/secrets/impact/personal_data_compromise.adoc[]
|
|
|
|
== How to fix it
|
|
|
|
include::../../../shared_content/secrets/fix/revoke.adoc[]
|
|
|
|
include::../../../shared_content/secrets/fix/vault.adoc[]
|
|
|
|
=== Code examples
|
|
|
|
:example_secret: xoxb-592666205443-2542034435697-FM7vdsq184d0G5vBNiOq8MSF8t7
|
|
:example_name: slack_bot_token
|
|
:example_env: SLACK_BOT_TOKEN
|
|
|
|
include::../../../shared_content/secrets/examples.adoc[]
|
|
|
|
//=== How does this work?
|
|
|
|
//=== Pitfalls
|
|
|
|
//=== Going the extra mile
|
|
|
|
== Resources
|
|
|
|
include::../../../shared_content/secrets/resources/standards.adoc[]
|
|
|
|
//=== Benchmarks
|