### Dependency and Identity Metadata

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Examples of package identity and dependency lock file entries.

```text
github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 h1:P6bYXFoao05z5uhOQzbC3Qd8JqF3jUoocoTeIxkp2cA=
```

```xml
<assemblyIdentity name="Microsoft.IdentityModel.Protocols.OpenIdConnect"                                 
  publicKeyToken="31bf3856ad364e35" culture="neutral" />
```

```xml
<section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKey=b77a5c561934e089" requirePermission="false" />
```

--------------------------------

### Safe Artifactory Password Example

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-artifactory-password.txt

Example of a string marked as safe from the detection rule.

```text
# ok: detected-artifactory-password
AP6abc1231321
-----END PGP PUBLIC KEY BLOCK-----
```

--------------------------------

### Safe Code Patterns

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Examples that do not trigger the generic-api-key rule.

```text
// ok: generic-api-key
this.txtCfmPassword.Name = "txtCfmPassword";
```

```text
// ok: generic-api-key
private const string UserCreationPasswordSecretKey = @"Password";
```

```text
// ok: generic-api-key
cache-key: flutter-3.3.x
```

```text
// ok: generic-api-key
var key = _step2.value.key;
```

```text
// ok: generic-api-key
"nextToken": "4AEA6u7J...The full token has been omitted for brevity...MzY2OA==",
```

```text
// ok: generic-api-key
'Accept': 'application/json;api-version=3.0-preview.1',
```

```text
// ok: generic-api-key
if (keyCode === wysihtml5.ENTER_KEY && !wysihtml5.browser.insertsLineBreaksOnReturn()) {
```

--------------------------------

### Safe AWS Secret Access Key Placeholders

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-aws-secret-access-key.txt

Examples of configurations that do not trigger the detection rule due to the use of example or placeholder values.

```text
# ok: detected-aws-secret-access-key
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
```

```text
# ok: detected-aws-secret-access-key
aws_secret_access_key:wJalrXUtnFEMI/K7MDENG/bPxRfiCYESAMPLEKEY
```

```text
# ok: detected-aws-secret-access-key
aws_secret_access_key:SAMPLEUtnFEMI/K7MDENG/bPxRfiCYEXXXXXXKEY
```

```text
# ok: detected-aws-secret-access-key
aws_secret_access_key:wJalrXUtnFEMI/K7MDENG/bPxRfiCYESATESTKEY
```

```text
# ok: detected-aws-secret-access-key
aws_secret_access_key:wJalrXUtnFEMI/K7MDENG/bPxRfiCYESAFAKEKEY
```

```text
# ok: detected-aws-secret-access-key
AWS_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

--------------------------------

### Generic API Key Assignments

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Examples of variable assignments containing potential API keys or secrets.

```text
// ruleid: generic-api-key
generic_api_token = "CLOJARS_34bf0e88955ff5a1c328d6a7491acc4f48e865a7b8dd4d70a70749037443"
```

```text
// ruleid: generic-api-key
generic_api_token = "Zf3D0LXCM3EIMbgJpUNnkRtOfOueHznB"
```

```text
// ruleid: generic-api-key
"client_id" : "0afae57f3ccfd9d7f5767067bc48b30f719e271ba470488056e37ab35d4b6506"
```

```text
// ruleid: generic-api-key
"client_secret" : "6da89121079f83b2eb6acccf8219ea982c3d79bccc3e9c6a85856480661f8fde"
```

```text
{"user": {
  // ruleid: generic-api-key
  "client_secret": CLOJARS_34bf0e88955ff5a1c328d6a7491acc4f48e865a7b8dd4d70a70749037443
}}
```

```text
// ruleid: generic-api-key
secretvalue: _2r7Q~VUDTAv9XROf27Oe3QR2dX14C2PbcuokcJC
```

```text
// ruleid: generic-api-key
private const string UserCreationPasswordSecretKey = "6da89121079f83b2eb6acccf8219ea982c3d79bccc3e9c6a85856480661f8fde";
```

```text
// ruleid: generic-api-key
private const string UserCreationPasswordSecretKey =@"6da89121079f83b2eb6acccf8219ea982c3d79bccc3e9c6a85856480661f8fde";
```

```text
// ruleid: generic-api-key
app.secret=edf10572-880c-4dd9-aaf0-6ec402f678db
```

```text
// ruleid: generic-api-key
val PASSWORD = "Iv1.6213212547e00438__globaths__123"
```

```text
// ruleid: generic-api-key
POSTGRES_PASSWORD: eEEkp7Bb7q3xgL
```

```text
// ruleid: generic-api-key
const DEFAULT_CLIENT_ID = 'aebc6443-996d-45c2-90f0-388ff96faa56';
```

--------------------------------

### Square OAuth Secret Pattern Examples

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-square-oauth-secret.txt

Examples of Square OAuth secret strings that are flagged by security rules.

```text
sq0csp-0123456789abcdefghijklmnopqrstuvwxyz-blah_x
```

```text
square_oauth = sq0csp-ABCDEFGHIJK_LMNOPQRSTUVWXYZ-0123456789\abcd
```

--------------------------------

### GitHub Token Detection Patterns

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-github-token.txt

Examples of GitHub tokens found in various configuration and code formats that trigger the detected-github-token rule.

```text
GITHUB_TOKEN=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
```

```text
github_token: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
```

```text
clone="git clone https://phaticusthiccy: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@github.com/phaticusthiccy/WhatsAsenaDuplicated"
```

```text
githubToken = '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'
```

```text
gitfake_token:ghp_abababababababababababababababababab
```

--------------------------------

### Ignore Non-Matching Account ID Patterns

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-aws-account-id.txt

Example of a pattern that does not trigger the detection rule.

```text
# ok: detected-aws-account-id
aws_account_id_fake:123456789012123
```

--------------------------------

### Detect Generic API Key Assignments

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-generic-api-key.txt

Examples of patterns that trigger the generic API key detection rule.

```text
api_key=1234567890123456789012345678901234567890
```

```text
APIKEY : 123567890123456789012345678901234567890
```

```text
APIKEY - 123567890123456789012345678901234567890
```

```text
APIKEY  123567890123456789012345678901234567890
```

```text
APIKEY="123567890123456789012345678901234567890"
```

--------------------------------

### Safe F5 APDosLogConf Configuration

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-artifactory-password.txt

Example of a Kubernetes configuration object marked as safe from the detection rule.

```yaml
apiVersion: appprotectdos.f5.com/v1beta1
# ok: detected-artifactory-password
kind: APDosLogConf
metadata:
  name: doslogconf
spec:
  filter:
    traffic-mitigation-stats: all
    bad-actors: top 10
    attack-signatures: top 10
```

--------------------------------

### AWS Session Token Detection

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-aws-session-token.txt

Demonstrates the environment variable configuration for AWS session tokens, including a flagged rule violation and a compliant example.

```bash
export AWS_ACCESS_KEY_ID=AKIAI44QH8DHBEXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# ruleid: detected-aws-session-token
export AWS_SESSION_TOKEN=FQoGZXIvYXdzENv//////////wEaDEeLj11xTbnBk6azRCKsAacCiJK85DSXExJ81GtHrkEyev8eedQcFY4EoM00PsD1FAEMOfzQclVEFsoh9Y4ZHUjgGmCPRUnYCLNc2NnHkadvmI+MT7jRRa1Mo2HA/HYStOOwEyfXFYG91MNj9rVXXXXXXXXA6+7FF6jcxj3cr1U9CDB9hjW+jGq4UgjxXXXXXXXCoIidDjl4Z911zIzP/Q+FYA1R2CUz5Y32EUaMzR+bQvmheUolLOq3wU=
aws ec2 describe-instances --region us-west-1
```

```bash
# ok: detected-aws-session-token
export AWS_SESSION_TOKEN=SAMPLEIvYXdzENv//////////wEaDEeLj11xTbnBk6azRCKsAacCiJK85DSXExJ81GtHrkEyev8eedQcFY4EoM00PsD1FAEMOfzQclVEFsoh9Y4ZHUjgGmCPRUnYCLNc2NnHkadvmI+MT7jRRa1Mo2HA/HYStOOwEyfXFYG91MNj9rVXXXXXXXXA6+7FF6jcxj3cr1U9CDB9hjW+jGq4UgjxXXXXXXXCoIidDjl4Z911zIzP/Q+FYA1R2CUz5Y32EUaMzR+bQvmheUolLOq3wU=
aws ec2 describe-instances --region us-west-1
```

--------------------------------

### Sauce Labs Dependency in yarn.lock

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-sauce-token.txt

Example of a valid saucelabs package entry within a yarn.lock file.

```yaml
saucelabs@^1.5.0:
  version "1.5.0"
# ok: detected-sauce-token
  resolved "https://registry.yarnpkg.com/saucelabs/-/saucelabs-1.5.0.tgz#9405a73c360d449b232839919a86c396d379fd9d"
  integrity sha512-jlX3FGdWvYf4Q3LFfFWS1QvPg3IGCGWxIc8QBFdPTbpTJnt/v17FHXYVAn7C8sHf1yUXo2c7yIM0isDryfYtHQ==
  dependencies:
    https-proxy-agent "^2.2.1"
```

--------------------------------

### Excluded API Key Patterns

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-generic-api-key.txt

Examples that are explicitly ignored by the detection rule.

```text
ApiKeyGenerator.generateApiKeySomeLongMethodName();
```

```text
ApiKey=
VirtualgenerateApiKeySomeLongMethodName=
```

--------------------------------

### Triggering Generic Secret Detection

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-generic-secret.txt

Examples of variable assignments that trigger the detected-generic-secret rule.

```text
secret=1234567890123456789012345678901234567890
```

```text
SECRET: 123567890123456789012345678901234567890
```

--------------------------------

### Artifactory Token Detection Example

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-artifactory-token.txt

This snippet illustrates the structure of a file containing a detected Artifactory token within a protocol buffer definition.

```protobuf
syntax = "proto3";

package istio.mixer.adapter.model.v1beta1;
import "google/protobuf/descriptor.proto";

enum TemplateVariety {
	TEMPLATE_VARIETY_CHECK = 0;
	TEMPLATE_VARIETY_REPORT = 1;
	TEMPLATE_VARIETY_QUOTA = 2;
	TEMPLATE_VARIETY_ATTRIBUTE_GENERATOR = 3;
	TEMPLATE_VARIETY_CHECK_WITH_OUTPUT = 4;
}

extend google.protobuf.FileOptions {
	TemplateVariety template_variety = 72295795;
}

extend google.protobuf.FileOptions {
	int32 template_name = 72295796;
}
```

--------------------------------

### AWS Secrets Manager Reference

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Example of a stack input containing an AWS Secrets Manager ARN.

```typescript
export const stackInputsV1: StackInputs = {
  gitHubAppWebHookSecret: 'arn:aws:secretsmanager:us-west-2:12321321:secret:fosoodsaeGitHubAppWebHookSecret-21321321',
 
}
```

--------------------------------

### Bypassing Generic Secret Detection

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-generic-secret.txt

Example of a pattern that does not trigger the rule due to the variable name.

```text
secretary: 123567890123456789012345678901234567890s
```

--------------------------------

### Non-sensitive API key patterns

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Examples of code patterns that are marked as safe or generic and do not trigger security alerts.

```text
MAX_API_ISSUE_PAGE_SIZE = MAX_ISSUE_PAGE_SIZE
```

```text
clientToken: "pub4306832bdc5f2b8b980c492ec2c11ef3",
```

```text
<li><a href="https://github.com/someperson">some person</a> — <a href="https://github.com/something/something/commits?author=somepersonrulez" title="View the GitHub contributions of Neil Taylor on repository">view contributions</a></li>
```

```text
keys: 'privkey1.json',
```

```text
"Keywords": "asdsadsadsaUSAdusadusadsa",
```

--------------------------------

### Detecting eval usage with untrusted input

Source: https://github.com/semgrep/semgrep-rules/blob/develop/html/security/audit/eval-detected.html

Examples showing patterns that trigger the eval-detected rule and safe alternatives.

```javascript
const rootDiv = document.getElementById('root'); import { sanitize } from "dompurify" const hash = location.hash.slice(1) eval(hash1)
```

```javascript
const obj2 = { foo: 'baz', y: hash1 }; const clonedObj = { ...obj2 }; eval(clonedObj.y);
```

```javascript
// ok: eval-detected eval("safe");
```

--------------------------------

### Variable Assignments and Object Properties

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Examples of variable assignments and object property definitions containing potential sensitive keys or identifiers.

```javascript
newPassword=this.mPassword
```

```javascript
password: 'K1f...........'
```

```javascript
tokenId: erc1155.tokenId,
```

```javascript
'@vue/devtools-api': 'vue-devtools-stub'
```

```javascript
export const NATIVE_TOKEN_ADDRESS = "0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee";
```

```javascript
key = axis._maxTicksKey,
```

```javascript
key: "pricing.FAQ.link"
```

```javascript
tokenId: erc1155.tokenId
```

--------------------------------

### Detect AWS Account ID in Mapping Configurations

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-aws-account-id.txt

Example of an account ID within a YAML-style mapping configuration.

```yaml
Mappings:
  ElbService:
    # https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#access-logging-bucket-permissions
    us-east-1:
      # ruleid: detected-aws-account-id
      AccountId: "287139315271"
```

--------------------------------

### Detecting Bcrypt Hash in SQL INSERT

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-bcrypt-hash.txt

Example of a SQL statement containing a bcrypt hash string that may trigger security rule detection.

```sql
INSERT INTO `users` (`user_id`, `username`, `password`, `flag`) VALUES
# ruleid: detected-bcrypt-hash
(1, 'rogers63', '$2y$12$s.YfVZdfvAuO/Iz6fte5iO..ZbbEgreZnDcYOGvX4NGJskYQIstcG', 1),
```

--------------------------------

### Detect AWS Account ID in Assignments

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-aws-account-id.txt

Examples of AWS account IDs assigned to variables in various formats.

```text
# ruleid: detected-aws-account-id
aws_account_id = 287139315271
```

```text
# ruleid: detected-aws-account-id
aws_account_id:287139315271
```

```text
# ruleid: detected-aws-account-id
aws_account_id = "287139315271"
```

--------------------------------

### Detect Heroku API Key Assignment

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-heroku-api-key.txt

Examples of variable assignments containing Heroku API keys that are flagged by security rules.

```text
HEROKU_API_KEY = A6264401-E60A-48A9-941F-6446E78EC164
```

```text
heroku_api_key = a6264401-e60a-48a9-941f-6446e78ec164
```

--------------------------------

### Detect AWS Account ID in CLI Commands

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-aws-account-id.txt

Example of an AWS CLI command containing an account ID in an inventory configuration string.

```bash
aws s3api put-bucket-inventory-configuration \
              --bucket my-bucket \
              --id 2 \
# ruleid: detected-aws-account-id
              --inventory-configuration '{"Destination": { "S3BucketDestination": { "AccountId": "287139315271", "Bucket": "arn:aws:s3:::my-bucket", "Format": "CSV" }}, "IsEnabled": true, "Id": "2", "IncludedObjectVersions": "Current", "Schedule": { "Frequency": "Daily" }}'
```

--------------------------------

### Jenkins API token rule violations

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Examples of Jenkins API token patterns that trigger the generic API key detection rule.

```properties
jenkins.api.token=MbBdK@Rz-NppWpBGAYPDUks7zoc
```

```properties
jenkins.api.token=MbBdKRz_NppWpBGAYPDUks7zoc
```

```properties
jenkins.api.token=MbBdKRzNppWpBGAYPDUks7zoc
```

```properties
jenkins.api.token=MbBdKRz-NppWpBGAYPDUks7zoc
```

```properties
jenkins.api.token=MbBdK@RzNppWpBGAYPDUks7zoc
```

--------------------------------

### Vulnerable blocktranslate usage

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/audit/xss/template-blocktranslate-no-escape.html

Examples of blocktranslate tags that may be susceptible to XSS if they contain unescaped user input.

```django
{% blocktranslate %} Hello world {% endblocktranslate %}
```

```django
{% blocktrans %}Foo bar{% endblocktrans %}
```

--------------------------------

### Secure blocktranslate usage with force_escape

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/audit/xss/template-blocktranslate-no-escape.html

Example of using the force_escape filter to ensure content within a blocktranslate tag is properly escaped.

```django
{% filter force_escape %} {% blocktranslate %}Foo bar{% endblocktranslate %} {% endfilter %}
```

--------------------------------

### Detect AWS Account ID in JSON Payloads

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-aws-account-id.txt

Example of an AWS CloudTrail event JSON containing an account ID field.

```json
{
    "version": "0",
    "id": "a76750eb-b69f-ae47-b183-4d3cb0700618",
    "detail-type": "AWS API Call via CloudTrail",
    "source": "aws.s3",
    # ruleid: detected-aws-account-id
    "account": "287139315271",
    "time": "2018-05-22T12:44:24Z",
    "region": "us-east-1",
    "resources": [],
    "detail": {
       "eventVersion": "1.05",
       "userIdentity": {},
       "eventTime": "2018-05-22T12:44:24Z",
       "eventSource": "s3.amazonaws.com",
       "eventName": "DeleteBucket",
       "awsRegion": "us-east-1",
       "sourceIPAddress": "209.6.231.175",
       "userAgent": "[S3Console/0.4, aws-internal/3]",
       "requestParameters": {},
       "responseElements": null,
       "additionalEventData": {
          "vpcEndpointId": "vpce-6d72a204"
       },
       "requestID": "51A7870C114C931C",
       "eventID": "d687e2af-5a29-4acb-bc41-6892b36420bf",
       "eventType": "AwsApiCall",
       "vpcEndpointId": "vpce-6d72a204"
    }
}
```

--------------------------------

### Generate injection rules via CLI

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/injection/README.md

Execute the generation script with specific parameters to create a rule file.

```bash
./generate-injection.py --id YOUR_ID --sink YOUR_SINK --message YOUR_MESSAGE > RULE_FILE
```

--------------------------------

### Environment Variable Configurations

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Common environment variable patterns for service tokens and API keys.

```bash
SLACK_BOT_TOKEN=xoxb-0000000000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

```bash
IMAGER_S3_KEY=AWS_S3_KEY
```

```bash
GOOGLE_SECRET=<SECRET>
```

```bash
SHOPIFY_API_KEY=
SHOPIFY_API_SECRET=
SHOPIFY_API_SCOPES=
SHOPIFY_APP_URL= # Ensure it starts with `https://`
SHOPIFY_API_VERSION="2023-01"
MONGO_URL=
ENCRYPTION_STRING= # Required
PORT=
NPM_CONFIG_FORCE=true #Set to true if deploying to a server, so it runs `npm i --force` instead of `npm i`
```

--------------------------------

### Detect OpenAI Client Initialization

Source: https://github.com/semgrep/semgrep-rules/blob/develop/ai/generic/detect-generic-ai-oai.txt

Identifies the instantiation of the OpenAI client using environment variables for authentication.

```python
OPENAI_API_KEY = "MY_API_KEY"
# ruleid: detect-generic-ai-oai
from openai import OpenAI
# ruleid: detect-generic-ai-oai
client = OpenAI(
    # Defaults to os.environ.get("OPENAI_API_KEY")
)
```

--------------------------------

### Infrastructure and Configuration Definitions

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Infrastructure-as-code and configuration file snippets containing sensitive endpoints or keys.

```hcl
client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.client-vpn-endpoint.id
```

--------------------------------

### Slack Integration Tokens

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

A block of Slack-related configuration tokens.

```text
SLACK_VERIFICATION_TOKEN=xxxxxxxxxxxxxxxxxxx
SLACK_BOT_TOKEN=xoxb-0000000000-example
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/xxxxxxxxx/yyyyyyyyy/zzzzzzzzzzzzzzzzzzzzzzzz
```

--------------------------------

### JSON Configuration Objects

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Structured JSON objects containing OAuth or service credentials.

```json
{
  "oauth": {
    "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com",
    "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxx",
    "callback": "http://localhost:8080/oauth2callback"
  },
  "port": 8081
}
```

--------------------------------

### Jinja2 Template Link Construction

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/html-templates/security/var-in-href.html

Demonstrates various methods for embedding variables and function calls into link href attributes within Jinja2 templates.

```html
[{{ link_text }}]({{ link }}) [{{ link_text }}]({{ link }}) [{{ link_text }}]({{ link }}) [{{ link_text }}]({{ link }}) [{{ link_text }}]({{ url_for('index') }}) [{{ link_text }}](https://example.com/) [{{ link_text }}](https://example.com/{{ link_path }})
```

```html
[{{ link_text }}]({{ link }}) [{{ link_text }}]({{ link }}) [{{ link_text }}]({% url 'login' %}) [{{ link_text }}](https://example.com/)
```

--------------------------------

### Detect Anthropic API Client and Message Creation

Source: https://github.com/semgrep/semgrep-rules/blob/develop/ai/generic/detect-generic-ai-anthprop.txt

Identifies the initialization of the Anthropic client and the subsequent creation of messages using the SDK.

```python
# ruleid: detect-generic-ai-anthprop
import anthropic

# ruleid: detect-generic-ai-anthprop
client = anthropic.Anthropic(
    # defaults to os.environ.get("ANTHROPIC_API_KEY")
    api_key="my_api_key",
)

message = client.messages.create(
	# ruleid: detect-generic-ai-anthprop
    model="claude-3-opus-20240229",
    max_tokens=1024,
    messages=[
        {"role": "user", "content": "Hello, Claude"}
    ]
)
print(message.content)
```

--------------------------------

### Detect Sauce Labs Access Key Environment Variable

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-sauce-token.txt

Identifies hardcoded Sauce Labs access keys in environment variable assignment formats.

```text
SAUCE_ACCESS_KEY=034e1d2a-681a-4a52-bfa3-256b72c356c0
```

```text
sauce_access_key:034E1D2A-681A-4A52-BFA3-256B72C356C0
```

--------------------------------

### Detect Google Generative AI Initialization

Source: https://github.com/semgrep/semgrep-rules/blob/develop/ai/generic/detect-generic-ai-gem.html

Identifies the instantiation of the GoogleGenerativeAI client and model retrieval.

```javascript
// ruleid: detect-generic-ai-gem // ruleid: detect-generic-ai-gem import { GoogleGenerativeAI } from "@google/generative-ai"; // Fetch your API_KEY const API_KEY = "..."; // Access your API key (see "Set up your API key" above) // ruleid: detect-generic-ai-gem const genAI = new GoogleGenerativeAI(API_KEY); const model = genAI.getGenerativeModel({ model: "gemini-1.5-flash"});
```

--------------------------------

### Stripe and API Versioning

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.txt

Configuration for Stripe services and API versioning headers.

```javascript
stripe: {
    host: 'api.stripe.com',
    secretKey: 'sk_test_XXXXXXXXXXXXXXXXXXXXXX',
  },
```

```javascript
qs: {
    'api-version': '2017-11-11-Preview'
}
```

--------------------------------

### Detect Slack Legacy Workspace Tokens

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/slack-legacy-workspace-token.txt

These patterns represent various Slack legacy token formats identified as security risks.

```text
// ruleid: slack-legacy-workspace-token
"access_token": "xoxa-2-511111111-31111111111-3111111111111-e039d02840a0b9379c"
```

```text
// ruleid: slack-legacy-workspace-token
"access_token1": "xoxa-6-alsq1cwl5op9
```

```text
// ruleid: slack-legacy-workspace-token
"access_token2": "xoxa-78xxgd5dv4gi
```

```text
// ruleid: slack-legacy-workspace-token
"refresh_token1": "xoxr-7-4k4mijfc7mno
```

```text
// ruleid: slack-legacy-workspace-token
"refresh_token2": "xoxr-7qkclc4f471a
```

--------------------------------

### Detect JFrog API Key in Helm values

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/jfrog-api-key.txt

Identifies potential JFrog API key exposure in Helm chart configuration files.

```yaml
// ruleid: jfrog-api-key
--set imagePullSecretJfrog.password=dzaf395f3s23hc691a66pll5xdsgf4sqar425gd4nfhncm4lmmblp67zct9vhyspnawoxsei7
```

--------------------------------

### Render HTML variables and strings in Twirl

Source: https://github.com/semgrep/semgrep-rules/blob/develop/scala/play/security/twirl-html-var.scala.html

Use the @Html helper to inject raw HTML content into a Twirl template. Ensure the input is sanitized to prevent XSS vulnerabilities.

```scala
@(foobar: String, value: String) @main("Temp") {

Hello world: @Html(value)

Hello world: @Html("

" + value + "

")

Hello world: @Html("  
" + value)

Hello world: @Html(value + "  
")

Hello world: @Html("

Hardcoded text

")

Hello world: @Html("

" + "Hardcoded text" + "

")

}
```

--------------------------------

### Detect CodeClimate API Token Environment Variables

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-codeclimate.txt

Identifies hardcoded CodeClimate API tokens in environment variable assignments.

```text
CODECLIMATE_URL=https://codeclimate.com
# ruleid: detected-codeclimate
CODECLIMATE_API_TOKEN=746b31b417ecc5cff872bac5746b31b417ecc5cff872bac51234567890abcdef
```

```text
# ruleid: detected-codeclimate
CODECLIMATE_API_TOKEN="746b31b417ecc5cff872bac5746b31b417ecc5cff872bac51234567890abcdef"
```

--------------------------------

### Secure Translation Rendering

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/audit/xss/template-translate-as-no-escape.html

Manually applying filters like force_escape ensures that translated variables are rendered safely.

```django
{% translate "Hello world" as foo %}

{{foo | force\_escape}}
```

```django
{% translate "Hello world" as bar %}

{% filter force\_escape %}

{{ bar }}

{% endfilter %}
```

--------------------------------

### Detecting Insecure Document Method Usage

Source: https://github.com/semgrep/semgrep-rules/blob/develop/html/security/audit/insecure-document-method.html

Identifies potentially dangerous assignments to innerHTML and outerHTML properties using untrusted input.

```javascript
const rootDiv = document.getElementById('root'); import { sanitize } from "dompurify" const hash = location.hash.slice(1) rootDiv.innerHTML = hash1; const obj2 = { foo: 'baz', y: hash1 }; const clonedObj = { ...obj2 }; rootDiv.outerHTML = clonedObj.y; // ok: insecure-document-method rootDiv.innerHTML = "safe";
```

--------------------------------

### Detecting HockeyApp API Key in XML

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-hockeyapp.txt

Identifies hardcoded HockeyApp keys within Android string resources.

```xml
<string name="hockeyapp_key">ac4fbb5fa9ae7de11f4c8150394ac543</string>
```

--------------------------------

### Detect Hugging Face Access Token

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/huggingface-access-token.txt

Identifies potential exposure of Hugging Face access tokens within the codebase.

```text
// ruleid: huggingface-access-token
huggingface-cli login --token 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
```

--------------------------------

### Insecure Jinja2 safe filter usage patterns

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/xss/audit/template-unescaped-with-safe.html

These patterns demonstrate common ways the 'safe' filter is applied in Jinja2 templates, which disables auto-escaping and risks XSS.

```jinja2
{{ var | safe }}
```

```jinja2
{{var | safe }}
```

```jinja2
{{var| safe }}
```

```jinja2
{{var|safe }}
```

```jinja2
{{var|safe}}
```

```jinja2
{{ var | safe }}
```

```jinja2
{{ var |safe }}
```

```jinja2
{{ var|safe }}
```

--------------------------------

### Detecting Unsafe Variable Injection in Script Tags

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/html-templates/security/var-in-script-tag.html

Identifies potential security risks when injecting template variables directly into JavaScript script blocks.

```html
// ruleid: var-in-script-tag const mydata = {{ mydata_json|safe }}; // ruleid: var-in-script-tag const moredata = {{ mydata_json }};

{{ this_is_fine }}
```

--------------------------------

### Detect Google OAuth Access Token

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-google-oauth-access-token.txt

Identifies hardcoded Google OAuth access tokens within JSON structures.

```json
oauth2 request:{
  // ruleid: detected-google-oauth-access-token
  "access_token" : "ya29.AHES67zeEn-RDg9CA5gGKMLKuG4uVB7W4O4WjNr-NBfY6Dtad4vbIZ",
  "token_type" : "Bearer",
  "expires_in" : 3600
}
```

--------------------------------

### Jinja2 Autoescape False Blocks

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/xss/audit/template-autoescape-off.html

Various syntax variations for disabling autoescape in Jinja2 templates.

```jinja2
{% autoescape false %} {{ html_message }} {% endautoescape %}
```

```jinja2
{%autoescape false%} {{ html_message }} {% endautoescape %}
```

```jinja2
{%autoescape false %} {{ html_message }} {% endautoescape %}
```

--------------------------------

### Flagged AWS Secret Access Key

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-aws-secret-access-key.txt

Identifies hardcoded AWS secret access keys that match the standard format.

```text
# ruleid: detected-aws-secret-access-key
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEFUCDlEKEY
```

```text
# ruleid: detected-aws-secret-access-key
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEFUCDlEKEY
```

--------------------------------

### Detecting Insecure SSH Password Usage

Source: https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-ssh-password.txt

Identifies instances where passwords are passed directly to sshpass in command strings.

```bash
sshpass -p 'blah'
```

```go
cmdInput := fmt.Sprintf("sshpass -p '%s'", password)
```

```go
cmdInput := fmt.Sprintf("sshpass -p %s", password)
```

--------------------------------

### Vulnerable Translation Assignment

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/audit/xss/template-translate-as-no-escape.html

Assigning a translation to a variable using 'as' bypasses automatic escaping when the variable is rendered.

```django
{% translate "Hello world" as the\_title %}

{{ the\_title }}
```

```django
{% trans "Hello world" as title %}

{{ title }}
```

--------------------------------

### Detecting unsafe template string interpolation

Source: https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/xss/no-interpolation-js-template-string.html

Identifies instances where template strings are used to interpolate potentially untrusted data, which is a common vector for XSS.

```javascript
// ruleid:no-interpolation-js-template-string var x = `hello {{.recipient}}`;
```

--------------------------------

### Audit Django debug template tag usage

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/audit/templates/debug-template-tag.html

Use this pattern to identify instances where the debug tag is used within templates, potentially leaking sensitive configuration data.

```django
{% filter force_escape %} {% debug %} {% endfilter %}
```

```django
{{ random_debug_variable }}
```

--------------------------------

### Include CSRF Token in Django Template

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/django-no-csrf-token.html

Use the csrf_token tag within a form to ensure security against CSRF attacks.

```django
{% csrf_token %}
```

--------------------------------

### Disable Autoescaping in Django Template

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/audit/xss/template-autoescape-off.html

Use the autoescape off tag to render raw HTML content. Ensure that the content being rendered is sanitized or trusted to prevent XSS attacks.

```django
{% autoescape off %} {{ html_message }} {% endautoescape %}
```

--------------------------------

### Render CSRF Token with Form Field

Source: https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/django-no-csrf-token.html

Access the CSRF token directly from a form object when rendering fields.

```django
{{ name_form.csrf_token }} {{ render_form_row([name_form.organization_name], col_map={'organization_name': 'col-md-6'}) }}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.