Packages
sobelow
0.2.6
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/config/secrets.ex
defmodule Sobelow.Config.Secrets do
@moduledoc """
# Hard-coded Secrets
In the event of a source-code disclosure via file read
vulnerability, accidental commit, etc, hard-coded secrets
may be exposed to an attacker. This may result in
database access, cookie forgery, and other issues.
Sobelow detects missing hard-coded secrets by checking the prod
configuration.
Hard-coded secrets checks can be ignored with the following command:
$ mix sobelow -i Config.Secrets
"""
alias Sobelow.Config
alias Sobelow.Utils
use Sobelow.Finding
@prod_path "config/prod.exs"
@prod_secret_path "config/prod.secret.exs"
def run(root) do
Config.get_configs_by_file(:secret_key_base, root <> @prod_path)
|> enumerate_secrets(root <> @prod_path)
Config.get_configs_by_file(:secret_key_base, root <> @prod_secret_path)
|> enumerate_secrets(root <> @prod_secret_path)
Config.get_configs_by_file(:password, root <> @prod_path)
|> enumerate_secrets(root <> @prod_path)
Config.get_configs_by_file(:password, root <> @prod_secret_path)
|> enumerate_secrets(root <> @prod_secret_path)
end
defp enumerate_secrets(secrets, file) do
file = Path.expand(file, "")
Enum.each secrets, fn {{_, [line: lineno], _} = fun, key, val} ->
if is_binary(val) && String.length(val) > 0 do
print_finding(file, lineno, fun, key, val)
end
end
end
defp print_finding(file, line_no, fun, key, val) do
IO.puts IO.ANSI.red() <> "Hardcoded Secret - High Confidence" <> IO.ANSI.reset()
IO.puts "File: #{file} - line #{line_no}"
IO.puts "Type: #{key}"
if Sobelow.get_env(:with_code), do: Utils.print_code(fun, :highlight_all)
IO.puts "\n-----------------------------------------------\n"
end
end