Rules / GL038
GL038 Hardcoded credential literal in script line
Severity: error
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene
What glsec checks
glsec flags script lines that pass a literal (non-variable) credential to a known CLI tool via a flag or environment variable:
| Tool | Detected pattern |
|---|---|
| sqlcmd | -P <literal> |
| mysql / mysqldump / mysqlpump | -p<literal> or --password=<literal> |
| psql | PGPASSWORD=<literal> |
| mongosh / mongodump / mongorestore | --password <literal> |
| sed | URL rewrite s/user:[^@]*@/user:<literal>@/ |
A value is considered hardcoded when it does not begin with $ (i.e. is not a CI variable reference).
Trigger example
restore-db:
script:
- sqlcmd -S localhost -U SA -P "ExampleP4ss!" -Q "RESTORE DATABASE [app] FROM DISK = '/backup/app.bak'"
- sed -i "s/sa:[^@]*@/sa:ExampleP4ss!@/" .env
Safe alternative
restore-db:
script:
- sqlcmd -S localhost -U SA -P "$MSSQL_SA_PASSWORD" -Q "RESTORE DATABASE [app] FROM DISK = '/backup/app.bak'"
- sed -i "s/sa:[^@]*@/sa:${MSSQL_SA_PASSWORD}@/" .env
Store the password as a masked, protected CI/CD variable in GitLab project or group settings.
References
- GitLab docs: Add a CI/CD variable
- GitLab docs: Mask a CI/CD variable
- GL006: hardcoded secret value in
variables:block - GL035: git URL with embedded credentials in script
- GL036: connection string with embedded credentials in
variables:block
See also
Enable the ShellCheck integration to surface additional shell issues in these script blocks.
Documentation for glsec 1.23.0. Source of this page · Rule implementation