TCE-1591 Create custom rule to detect hardcoded tokens for yaml files

[DMarinhoCodacy]

No description provided.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The token-detection rule has a substantive coverage gap: common token key names and YAML scalar representations are not detected, so hardcoded tokens can bypass the rule. This should be addressed before merging.

The acceptance criteria around token detection and SSRF mapping lack automated test coverage. Codacy reports the PR as up to standards, but no coverage data is available for these changes.

About this PR

• Please document the supported token-key/value syntax and add automated tests for the rule and OWASP mapping. The unrelated SSRF mapping change also needs its relationship to this PR clarified.

Test suggestions

• Detect a quoted hardcoded value for a key such as access_token or api-token.
• Detect token keys in common forms such as token, token_value, and TOKEN_VALUE.
• Do not report token keys whose values are absent or non-hardcoded placeholders, according to the intended rule behavior.
• Map A10:2021 server-side request forgery and its abbreviated form to InputValidation.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Detect a quoted hardcoded value for a key such as access_token or api-token.
2. Detect token keys in common forms such as token, token_value, and TOKEN_VALUE.
3. Do not report token keys whose values are absent or non-hardcoded placeholders, according to the intended rule behavior.
4. Map A10:2021 server-side request forgery and its abbreviated form to InputValidation.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}