rules:
  - id: named-credentials-constant-match
    min-version: 1.44.0
    mode: taint
    severity: ERROR
    languages:
      - apex
    metadata:
      cwe:
      - 'CWE-540: Inclusion of Sensitive Information in Source Code'
      impact: HIGH
      likelihood: LOW
      confidence: HIGH
      category: security
      subcategory:
      - vuln
      technology:
      - salesforce
      references:
      - https://cwe.mitre.org/data/definitions/540.html
    message: >-
      Named Credentials (and callout endpoints) should be used instead of hard-coding credentials.
      1. Hard-coded credentials are hard to maintain when mixed in with application code.
      2. It is particularly hard to update hard-coded credentials when they are used amongst different classes.
      3. Granting a developer access to the codebase means granting knowledge of credentials, and thus keeping a two-level access is not possible.
      4. Using different credentials for different environments is troublesome and error-prone.
    pattern-sources:
      - pattern: ...String $X = 'Authorization';
    pattern-sinks:
      - patterns:
        - pattern: req.setHeader($X, ...);
        - focus-metavariable: $X