From 42138503bf8de0deeb951cf98f3c93fb112532f7 Mon Sep 17 00:00:00 2001 From: DMarinhoCodacy Date: Wed, 21 Oct 2026 16:45:04 +0100 Subject: [PATCH 1/3] Improve YAML Hardcoded tokens custom rule --- docs/codacy-rules.yaml | 9 ++++++++- docs/multiple-tests/codacy-rules/patterns.xml | 1 + docs/multiple-tests/codacy-rules/results.xml | 14 ++++++++++++++ ...odacy.yaml.security.hard-coded-tokens.yaml | 19 +++++++++++++++++++ ...ils.py => codacy_openai_non_guardrails.py} | 0 5 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 docs/multiple-tests/codacy-rules/src/codacy.yaml.security.hard-coded-tokens.yaml rename docs/multiple-tests/codacy-rules/src/{codacy_apenai_non_guardrails.py => codacy_openai_non_guardrails.py} (100%) diff --git a/docs/codacy-rules.yaml b/docs/codacy-rules.yaml index 9af4ca1..e6e62c8 100644 --- a/docs/codacy-rules.yaml +++ b/docs/codacy-rules.yaml @@ -645,8 +645,15 @@ rules: severity: ERROR languages: - generic - patterns: + pattern-either: + # any key containing _token / -token with a single-word value - pattern-regex: '(?i)^\s*[\w-]*[_-]token[_-]?[\w-]*\s*:\s*["'']?[^\s"'']+["'']?\s*$' + # Same keys with a {{ ... }} template value containing spaces + - pattern-regex: '(?i)^\s*[\w-]*[_-]token[_-]?[\w-]*\s*:\s*["'']?\{\{[^}\n]*\}\}["'']?\s*$' + # Key named token / *_token / *-token with a literal value (skips booleans, numbers, null, templates, env refs, anchors, block scalars) + - pattern-regex: '(?i)^\s*(?:[\w-]*[_-])?token\s*:\s*(?!(?:true|false|yes|no|null|~|-?\d+(?:\.\d+)?)\s*(?:#.*)?$)(?!["'']?\s*(?:\{\{|\$\{|\$[A-Z_]|<%|%\{))(?:"[^"\n]{8,}"|''[^''\n]{8,}''|[^\s"''#|>&*!{\[][^\s#]{7,})\s*(?:#.*)?$' + # Well-known token formats under any key (GitHub, GitLab, Slack, npm) + - pattern-regex: '\b(?:gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|npm_[A-Za-z0-9]{36})\b' message: Hardcoded tokens are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system. metadata: owasp: diff --git a/docs/multiple-tests/codacy-rules/patterns.xml b/docs/multiple-tests/codacy-rules/patterns.xml index 61bca42..ece50de 100644 --- a/docs/multiple-tests/codacy-rules/patterns.xml +++ b/docs/multiple-tests/codacy-rules/patterns.xml @@ -16,4 +16,5 @@ + diff --git a/docs/multiple-tests/codacy-rules/results.xml b/docs/multiple-tests/codacy-rules/results.xml index 924a099..342cb1c 100644 --- a/docs/multiple-tests/codacy-rules/results.xml +++ b/docs/multiple-tests/codacy-rules/results.xml @@ -56,4 +56,18 @@ + + + + + + + + + + + + + + diff --git a/docs/multiple-tests/codacy-rules/src/codacy.yaml.security.hard-coded-tokens.yaml b/docs/multiple-tests/codacy-rules/src/codacy.yaml.security.hard-coded-tokens.yaml new file mode 100644 index 0000000..64cba19 --- /dev/null +++ b/docs/multiple-tests/codacy-rules/src/codacy.yaml.security.hard-coded-tokens.yaml @@ -0,0 +1,19 @@ +# Should be flagged +gh_token: >- +gh_token: "{{gh_token}}" +gh_token: "{{ gh_token }}" +gh_token: '{{ secrets.GH }}' +gh_token: "correct horse battery staple" +max_tokens: 4096 +access_token_ttl: 3600 +use_refresh_token: true +auth-token: "s3cr3tValue99" +Token: 'abcdef123456' +token: ghp_EXAMPLEexampleEXAMPLEexample00001234 +slack_token: xoxb-1234567890-abcdef + +# Should not be flagged +name: "{{ gh_token }}" +token: true +token: abc +api_key: some-value diff --git a/docs/multiple-tests/codacy-rules/src/codacy_apenai_non_guardrails.py b/docs/multiple-tests/codacy-rules/src/codacy_openai_non_guardrails.py similarity index 100% rename from docs/multiple-tests/codacy-rules/src/codacy_apenai_non_guardrails.py rename to docs/multiple-tests/codacy-rules/src/codacy_openai_non_guardrails.py From fa7641d25983e2efaaf34630ca4a4c509ae8a8ec Mon Sep 17 00:00:00 2001 From: DMarinhoCodacy Date: Wed, 21 Oct 2026 17:51:25 +0100 Subject: [PATCH 2/3] fix tests --- docs/multiple-tests/codacy-rules/results.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/multiple-tests/codacy-rules/results.xml b/docs/multiple-tests/codacy-rules/results.xml index 342cb1c..980a72f 100644 --- a/docs/multiple-tests/codacy-rules/results.xml +++ b/docs/multiple-tests/codacy-rules/results.xml @@ -34,7 +34,7 @@ - + @@ -69,5 +69,7 @@ + + From c1e360b7850a5779910642f76ba959504956538c Mon Sep 17 00:00:00 2001 From: DMarinhoCodacy Date: Wed, 21 Oct 2026 17:57:07 +0100 Subject: [PATCH 3/3] fix tests --- docs/multiple-tests/codacy-rules/results.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/multiple-tests/codacy-rules/results.xml b/docs/multiple-tests/codacy-rules/results.xml index 980a72f..aa921d8 100644 --- a/docs/multiple-tests/codacy-rules/results.xml +++ b/docs/multiple-tests/codacy-rules/results.xml @@ -68,6 +68,7 @@ +