feat(secret): add detection for Symfony default secret key

[murataslan1]

Summary

Add a new secret detection rule for the old default Symfony secret key ThisTokenIsNotSoSecretChangeIt.

Details

When projects were bootstrapped with older versions of Symfony (< 4.0), the configuration was generated with a default secret key. This key can be exploited for Remote Code Execution (RCE).

Changes

• Added CategorySymfony to secret categories
• Added symfony-secret rule to detect ThisTokenIsNotSoSecretChangeIt
• Severity: HIGH (due to RCE risk)

Detection examples

# parameters.yml
parameters:
    secret: ThisTokenIsNotSoSecretChangeIt

# .env
APP_SECRET=ThisTokenIsNotSoSecretChangeIt

References

• Fixes #3910
• Symfony Secret Fragment RCE
• symfony-standard parameters.yml.dist

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}