Repository navigation
Bundled semgrep rules for secret env fallbacks and secrets behind public prefixes - #2187
Merged
Merged
Conversation
…lic prefixes Adds three bundled semgrep rules to the deep-code-review templates. perun.js.secret-env-fallback and perun.py.secret-env-fallback report a secret-named environment variable that falls back to a hardcoded string (||, ??, ||=, ??=, a destructuring default, an os.environ.get or os.getenv default, setdefault, or `or`), because wherever the variable is unset the service silently runs with a known secret. Empty, sentinel and file-path literals stay clean, and test paths plus test-runner configs are skipped. perun.js.public-env-secret reports a secret-named variable behind a public bundler prefix such as NEXT_PUBLIC_ or VITE_, because a bundler inlines such variables into any client code that reads them. The name and literal regexes are shared with hardcoded-credential-compare, whose test now checks them per rule. Each file's header lists the limits: optional chaining, a value copied to a variable first and value-based fallbacks are not followed. Tests: run-ci-tests.sh --affected 10/10 on an identical tree, semgrep live; held-out fictional fixtures 29/29 reported with 0 false positives; changelog fragments 23/23 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Perun's bundled semgrep pack gains 3 rules that report a secret env variable silently falling back to a hardcoded value and a secret-looking variable behind a public bundler prefix, in JavaScript and Python.
What changes
js.yml:perun.js.secret-env-fallback(||,??,||=,??=, destructuring defaults) andperun.js.public-env-secret(NEXT_PUBLIC_,VITE_and seven other prefixes).py.yml:perun.py.secret-env-fallback(os.environ.getandos.getenvdefaults,setdefault,or).ACME_TOKEN_TTLstays clean; empty, sentinel and file-path fallbacks stay clean; test paths and test-runner configs are skipped.test_semgrep_secret_env.py;test_semgrep_hardcoded_cred.pychecks the shared literal regex per rule.Known limits
Verification
Tests: run-ci-tests.sh --affected 10/10 on an identical tree, semgrep live; held-out fictional fixtures 29/29 reported with 0 false positives; changelog fragments 23/23
🤖 Generated with Claude Code