Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Stop reporting ballerina:13 and ballerina:14 for values that are not secrets

Open
  • Is something wrong?
#109 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
java
Domain
security, tooling

Research direction

Start with the implementations of the ballerina:13 and ballerina:14 rules, which decide secrets from the names of targets, and reproduce with bal scan --format=sarif on the main.bal and tests/t.bal samples in the issue. Done when the four listed false positives stop being reported (non-string values, configurable-only values, protocol keywords like access_token at error level, and test sources), while the genuine secret cases still fire.

Written by the indexing model from the issue text.

Description

Type/Bug
Description

Rules ballerina:13 (hard-coded secrets) and ballerina:14 (non-configurable secrets) decide what is a secret from the name of the target: a parameter, field, named argument or map key containing words such as auth, key, token or password. They report several kinds of values that are not secrets, or that already come from configurables:

  1. A boolean flag with a secret-like name. basicAuthEnabled = true is a switch, not a secret. This is reported both as a parameter default and as a named argument.
  2. A value built only from configurables. A credentials record or an Authorization header built from configurable variables is reported where it is used. The declaration of the same record isn't reported, so the rule contradicts itself.
  3. A protocol keyword. tokenTypeHint: "access_token" is the RFC 7662 token_type_hint value, not a credential. It is reported as ballerina:13 at error level, so it fails GitHub code scanning checks.
  4. Test sources. A test that checks that a wrong password is refused has to send a fixed wrong password. Making it configurable doesn't help rotation, and the values are not real secrets.

Related false positives for ballerina:14: #104 (nil default) and #105 (function call result).

Each finding is noise that hides real ones. Because ballerina:13 is error-level, case 3 also fails the code scanning check on pull requests.

Steps to Reproduce

Scan this package with bal scan --format=sarif:

main.bal:

import ballerina/http;

configurable string username = ?;
configurable string password = ?;
configurable string introspectionUrl = ?;

// Case 1: a boolean flag whose name contains "auth".
function configure(boolean basicAuthEnabled = false) returns boolean => basicAuthEnabled;   // ballerina:14

public function caseBoolean() returns boolean => configure(basicAuthEnabled = true);       // ballerina:14

// Case 2: a value built only from configurables.
final http:CredentialsConfig credentials = {username, password};                             // not reported

public function caseDerived() returns http:Client|error =>
    new ("http://localhost:9090", auth = credentials);                                        // ballerina:14

public function caseHeader() returns map<string> =>
    {"Authorization": "Basic " + string `${username}:${password}`.toBytes().toBase64()};     // ballerina:14

// Case 3: a protocol keyword in a field whose name contains "token".
public function caseHint() returns http:ListenerOAuth2Handler =>
    new ({url: introspectionUrl, tokenTypeHint: "access_token"});                            // ballerina:13 (error)

tests/t.bal:

import ballerina/http;
import ballerina/test;

// Case 4: a test that must send a credential the server is configured to reject.
@test:Config {}
function testWrongPasswordIsRefused() returns error? {
    http:Client c = check new ("http://localhost:9090", auth = {username: "ops", password: "wrong"}); // ballerina:13 + ballerina:14
    test:assertTrue(c is http:Client);
}

Actual behavior: six ballerina:14 and two ballerina:13 findings, as marked above.

Expected behavior:

  • ballerina:14 is not reported for non-string values (booleans, numbers, nil), or for values whose every input is a configurable variable.
  • ballerina:13 is not reported for well-known protocol keywords such as access_token, refresh_token and Bearer, or it is at least not error-level for them.
  • Test sources are excluded from both rules, or reported at a lower level, because test fixtures cannot be configurables in any useful sense.

The scanner already follows a constant to its literal (tokenTypeHint: HINT with const HINT = "access_token" is still reported). So for case 3, the only change a user can make to the code is to stop sending the value.

Version

scan tool 0.12.0, Ballerina 2201.14.0

Environment Details (with versions)

macOS (arm64), JDK 25. The same findings appear in the GitHub code scanning results of the ballerina-library pull request build template (bal scan with exclude-tests: false).

Dominant language
Java
Stars
15
Forks
12
Avg merge
12h 17m
Merged PRs (30d)
13

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ballerina-platform/static-code-analysis-tool

All issues in ballerina-platform/static-code-analysis-tool

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.