ast-grep-essentials/tests/python/jwt-python-hardcoded-secret-python-test.yml at main · coderabbitai/ast-grep-essentials · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
id: jwt-python-hardcoded-secret-python
valid:
  - |
    encoded = jwt.encode({"some": "payload"}, secret_key, algorithm="HS256")
    secret_const = 3
  - |
    encoded = jwt.encode({"some": "payload"}, secret_const, algorithm="HS256")
    return encoded

invalid:
  - |
    encoded = jwt.encode({"some": "payload"}, "secret", algorithm="HS256")
  - |
    encoded = jwt.encode({'some': 'payload'}, 'secret', algorithm='HS256')
  - |
    secret = "secret"
    encoded = jwt.encode({"some": "payload"}, secret, algorithm="HS256")
  - |
    secret_const = "this-is-secret"
    def bad2():
    encoded = jwt.encode({"some": "payload"}, secret_const, algorithm="HS256")