secrets-parameters.yml

rules:
  sec-apikeys-url:
    description: |-
      API Keys are (usually opaque) strings that
      are passed in headers, cookies or query parameters
      to access APIs.

      Those keys can be eavesdropped, especially when they are stored
      in cookies or passed as URL parameters.

      ```
      security:
      - ApiKey: []
      paths:
        /books: {}
        /users: {}
      securitySchemes:
        ApiKey:
          type: apiKey
          in: cookie
          name: X-Api-Key
      ```

    message: >-
      ApiKey passed in URL: {{error}}.
    formats:
    - oas3
    severity: error
    recommended: true
    given:
    - >-
      $..[securitySchemes][?(@ && @.type=="apiKey")].in
    then:
    - function: pattern
      functionOptions:
        notMatch: >-
          ^(query)$

  sec-credentials-parameters: &sec-credentials-parameters
    description: |-
      URL parameters MUST NOT contain credentials such as
      apikey, password, or secret.

      See [RAC_GEN_004](https://docs.italia.it/italia/piano-triennale-ict/lg-modellointeroperabilita-docs/it/bozza/doc/04_Raccomandazioni%20di%20implementazione/04_raccomandazioni-tecniche-generali/01_globali.html?highlight=credenziali#rac-gen-004-non-passare-credenziali-o-dati-riservati-nellurl)

    message: >-
      Credentials are sent via URLs. {{path}} {{error}}
    formats:
      - oas3
    severity: error
    recommended: true
    given:
      - >-
        $..parameters[?(@ && @.in && @.in.match(/query|path/))].name
    then:
      - field: name
        function: pattern
        functionOptions:
          notMatch: >-
           /^.*(password|secret|apikey).*$/i