py/HardcodedCredentials misses common credential patterns and flags usernames.
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start with the py/HardcodedCredentials rule and reproduce the API-key, URL-credential, username, and options examples from the issue. Read how the rule models credential patterns and propagates taint through the options dictionary. Done means the missing credential cases are detected without treating ordinary usernames as credentials, with coverage for the reported examples.
Written by the indexing model from the issue text.
Description
Some patterns are missing, for example:
api_key = "sk-1234567890" # Missed: API key
db_url = "postgres://user:pass@host/db" # Missed: URL credentials
Second, I am not sure if the username is seen as a credential in a usual project, but this rule will flag the username.
This is beyond the definition in CWE-798 (
The product contains hard-coded credentials, such as a password or cryptographic key.)
USERNAME = "admin" # Flagged
I also found that the rule will lose the taint in the following case:
USERNAME = "road_runner"
PASSWORD = "insecure_pwd"
options = {"password": PASSWORD}
conn = client.connect(username=USERNAME, password=PASSWORD) # Flagged
log.debug("Options: %s", options) # Missing
conn = client.connect(options=options) # Still Missing
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 143
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/codeql
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
false-positive javascript
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
C#: cs/simplifiable-boolean-expression false positive on Nullable<bool> compared with a literal Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
false-positive
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
punkpeye/mcp-remote#369 ·
-
Mend: dependency security vulnerability untriaged
Difficulty 1/5 Under an hour Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
cisagov/vulnrichment#337 ·
-
bug DUP Reservations
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
bcgov/reserve-rec-public#896 ·