Skip to content

Update rule java_password_rule-HardcodeKey and add tests

Bhavya Kaushal requested to merge java-hardcoded-keys into main

What does this MR do?

This MR updates the java_password_rule-HardcodeKey rule. The original intent of the issue was to add HMAC patterns from the jwt-hardcode.java-jwt-hardcoded-secret community rule into the existing java_password_rule-HardcodeKey rule.

I updated the community rule to cover more cases and to be better optimized before adding it to the gitlab rule. I also had to update the existing gitlab rule patterns, as some of them were not accurate and a lot of cases were not covered. I researched and added more patterns from libraries / methods that had not been covered. I created the test cases for the new patterns and also created test cases for the existing patterns present in the rule.

What are the relevant issue numbers?

Addresses issue : gitlab-org/gitlab#438811 (closed)

Merge request reports