Repository: Checkmarx/kics (language: python)

Issue:
Passwords And Secrets - Generic Password fale positive on null values
### Expected Behavior

`Passwords And Secrets - Generic Password` (`487f4be7-3fd9-4506-a07a-eae252180c08`) finds valid plaintext passwords in infrastructure code


### Actual Behavior

(Formatted logs and samples helps us to better understand the issue)

`Passwords And Secrets - Generic Password` is being triggered incorrectly by a `null` value, which can be valid in certain instances such as creating an RDS Replica (which inherits the password from it's parent). Specifically this happens when the null value is in a tenary:

```
Passwords And Secrets - Generic Password, Severity: HIGH, Results: 1
Description: Query to find passwords and secrets in infrastructure code.
Platform: Common
Learn more about this vulnerability: https://docs.kics.io/latest/queries/common-queries/common/487f4be7-3fd9-4506-a07a-eae252180c08

	[1]: ../../path/terraform/modules/gitlab_ref_arch_aws/rds.tf:67

		010:   username = local.rds_postgres_is_primary ? var.rds_postgres_username : null
		011:   password = local.rds_postgres_is_primary ? var.rds_postgres_password : <SECRET-MASKED-ON-PURPOSE>
		012:
```

Where `<SECRET-MASKED-ON-PURPOSE>` is `null`, which is equivalent to "don't set".

This worked fine recently but started to fail with `v.1.7.2`.

### Steps to Reproduce the Problem

Attempt to configure an RDS instance with password set based on condition with `null` being the second option.




Discussion / hints:

Fix patch:
diff --git a/assets/queries/common/passwords_and_secrets/regex_rules.json b/assets/queries/common/passwords_and_secrets/regex_rules.json
index f0cef4a3864..c6e2ecb2eb5 100644
--- a/assets/queries/common/passwords_and_secrets/regex_rules.json
+++ b/assets/queries/common/passwords_and_secrets/regex_rules.json
@@ -5,6 +5,10 @@
       "name": "Generic Password",
       "regex": "(?i)['\"]?password['\"]?\\s*[:=]\\s*['\"]?([A-Za-z0-9/~^_!@&%()=?*+-. ]{4,})['\"]?",
       "allowRules": [
+        {
+          "description": "Avoiding TF resource access",
+          "regex": "(?i)['\"]?password['\"]?\\s*=\\s*(([a-zA-z_]+(.))?[a-zA-z_]+\\s*(.)\\s*[a-zA-z_]+(.)[a-zA-z_]+)?(\\s*:\\s*null|null)?$"
+        },
         {
           "description": "Avoiding CF AllowUsersToChangePassword",
           "regex": "['\"]?AllowUsersToChangePassword['\"]?\\s*[:=]\\s*['\"]?([A-Za-z0-9/~^_!@&%()=?*+-.]{4,})['\"]?"


Test patch:
diff --git a/assets/queries/common/passwords_and_secrets/test/negative55.tf b/assets/queries/common/passwords_and_secrets/test/negative55.tf
new file mode 100644
index 00000000000..0188abcc114
--- /dev/null
+++ b/assets/queries/common/passwords_and_secrets/test/negative55.tf
@@ -0,0 +1,20 @@
+#this is a problematic code where the query should report a result(s)
+resource "google_container_cluster" "primary1" {
+  name               = "marcellus-wallace"
+  location           = "us-central1-a"
+  initial_node_count = 3
+
+  master_auth {
+    username = ""
+    password = local.rds_postgres_is_primary ? var.rds_postgres_password : null
+
+    client_certificate_config {
+      issue_client_certificate = true
+    }
+  }
+
+  timeouts {
+    create = "30m"
+    update = "40m"
+  }
+}
diff --git a/assets/queries/common/passwords_and_secrets/test/positive45.tf b/assets/queries/common/passwords_and_secrets/test/positive45.tf
new file mode 100644
index 00000000000..e668c2aca0c
--- /dev/null
+++ b/assets/queries/common/passwords_and_secrets/test/positive45.tf
@@ -0,0 +1,20 @@
+#this is a problematic code where the query should report a result(s)
+resource "google_container_cluster" "primary1" {
+  name               = "marcellus-wallace"
+  location           = "us-central1-a"
+  initial_node_count = 3
+
+  master_auth {
+    username = ""
+    password = local.rds_postgres_is_primary ? var.rds_postgres_password : "null"
+
+    client_certificate_config {
+      issue_client_certificate = true
+    }
+  }
+
+  timeouts {
+    create = "30m"
+    update = "40m"
+  }
+}
diff --git a/assets/queries/common/passwords_and_secrets/test/positive_expected_result.json b/assets/queries/common/passwords_and_secrets/test/positive_expected_result.json
index 25aa689c32b..c28d005349c 100644
--- a/assets/queries/common/passwords_and_secrets/test/positive_expected_result.json
+++ b/assets/queries/common/passwords_and_secrets/test/positive_expected_result.json
@@ -370,5 +370,11 @@
     "severity": "HIGH",
     "line": 17,
     "fileName": "positive44.yaml"
+  },
+  {
+    "queryName": "Passwords And Secrets - Generic Password",
+    "severity": "HIGH",
+    "line": 9,
+    "fileName": "positive45.tf"
   }
 ]